Threats Tagged 'cve-2026-72693'

CVE-2026-72693 is a local privilege escalation vulnerability in Red Hat Enterprise Linux 10 affecting the openvt utility. The flaw arises from improper process owner verification in openvt's authenticate_user() function, which relies on the ownership of the TTY device node rather than the actual process owner. This can lead to a passwordless root login if a specific non-default kbrequest/init configuration uses openvt -u and a narrow timing condition occurs where the TTY ownership reverts to root while an unprivileged process still holds an open file descriptor. Red Hat rates the real-world impact as moderate due to the uncommon configuration and timing requirements despite a high CVSS score. Mitigation involves avoiding the use of openvt -u in privileged kbrequest/init setups or disabling the keyboard request binding until a fix is available.