`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.

The version of kbd installed on the remote host is prior to 1.15.5-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3885 advisory.

    `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from     a privileged context. In the documented `kbrequest`/init usage, the ownership test in     `authenticate_user()` relies on `stat(/proc/<pid>/fd/0)`. `stat()` on `/proc/<pid>/fd/0` follows the     symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node     rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or     the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the     check can incorrectly treat that process as belonging to the privileged console owner. Once that check     succeeds, the `-u` path executes a passwordless login as the selected user. In the documented     `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the     spawned VT. This report establishes that privilege escalation path for that documented deployment; it does     not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged     `kbrequest`/init path. (CVE-2026-72693)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2109 advisory.

    `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from     a privileged context. In the documented `kbrequest`/init usage, the ownership test in     `authenticate_user()` relies on `stat(/proc/<pid>/fd/0)`. `stat()` on `/proc/<pid>/fd/0` follows the     symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node     rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or     the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the     check can incorrectly treat that process as belonging to the privileged console owner. Once that check     succeeds, the `-u` path executes a passwordless login as the selected user. In the documented     `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the     spawned VT. This report establishes that privilege escalation path for that documented deployment; it does     not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged     `kbrequest`/init path. (CVE-2026-72693)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-71a5fbb962 advisory.

    Fix openvt -u process matching to be more conservative (CVE-2026-72693)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1640:01 advisory.

    * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless     root login (CVE-2026-72693)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57597 advisory.

    * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless     root login (CVE-2026-72693)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57610 advisory.

    * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless     root login (CVE-2026-72693)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57610 advisory.

    * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless     root login (CVE-2026-72693)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57597 advisory.

    * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless     root login (CVE-2026-72693)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57610 advisory.

    [2.4.0-12]
    - Fix CVE-2026-72693: openvt -u process matching made more conservative       Resolves: RHEL-235988

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57597 advisory.

    [2.6.4-8]
    - Fix openvt -u process matching to be more conservative (CVE-2026-72693)       Resolves: RHEL-235987

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57597 advisory.

    The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard,     screen fonts, virtual terminals, and font files.

    Security Fix(es):

    * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless     root login (CVE-2026-72693)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57610 advisory.

    The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard,     screen fonts, virtual terminals, and font files.

    Security Fix(es):

    * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless     root login (CVE-2026-72693)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from     a privileged context. In the documented `kbrequest`/init usage, the ownership test in     `authenticate_user()` relies on `stat(/proc/<pid>/fd/0)`. `stat()` on `/proc/<pid>/fd/0` follows the     symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node     rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or     the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the     check can incorrectly treat that process as belonging to the privileged console owner. Once that check     succeeds, the `-u` path executes a passwordless login as the selected user. In the documented     `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the     spawned VT. This report establishes that privilege escalation path for that documented deployment; it does     not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged     `kbrequest`/init path. (CVE-2026-72693)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341904	Amazon Linux 2 : kbd, --advisory ALAS2-2026-3885 (ALAS-2026-3885)	Nessus	Amazon Linux Local Security Checks	Local	high
341833	Amazon Linux 2023 : kbd, kbd-legacy, kbd-misc (ALAS2023-2026-2109)	Nessus	Amazon Linux Local Security Checks	Local	high
341796	Fedora 44 : kbd (2026-71a5fbb962)	Nessus	Fedora Local Security Checks	Local	high
339113	MiracleLinux 9 : kbd-2.4.0-12.el9_8 (AXSA:2026-1640:01)	Nessus	Miracle Linux Local Security Checks	Local	high
338770	RockyLinux 10 : kbd (RLSA-2026:57597)	Nessus	Rocky Linux Local Security Checks	Local	high
338769	RockyLinux 9 : kbd (RLSA-2026:57610)	Nessus	Rocky Linux Local Security Checks	Local	high
338763	AlmaLinux 9 : kbd (ALSA-2026:57610)	Nessus	Alma Linux Local Security Checks	Local	high
338758	AlmaLinux 10 : kbd (ALSA-2026:57597)	Nessus	Alma Linux Local Security Checks	Local	high
338721	Oracle Linux 9 : kbd (ELSA-2026-57610)	Nessus	Oracle Linux Local Security Checks	Local	high
338719	Oracle Linux 10 : kbd (ELSA-2026-57597)	Nessus	Oracle Linux Local Security Checks	Local	high
338416	RHEL 10 : kbd (RHSA-2026:57597)	Nessus	Red Hat Local Security Checks	Local	high
338413	RHEL 9 : kbd (RHSA-2026:57610)	Nessus	Red Hat Local Security Checks	Local	high
334496	Linux Distros Unpatched Vulnerability : CVE-2026-72693	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-72693

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high