Local Privilege Escalation via openvt Authentication Bypass (CVE-2026-72693)

CVE-2026-72693 is a local privilege escalation vulnerability in the openvt command within the util-linux package. The flaw exists in the authenticate_user() function, which validates the owner of the current virtual terminal (VT) to authorize execution of login. The function incorrectly utilizes stat() on /proc/<pid>/fd/0, which resolves the file descriptor symlink to the underlying TTY device node rather than verifying the actual process owner.

If an unprivileged process maintains an open file descriptor to a TTY after the previous user session has logged out and the TTY device ownership has reverted to root or another privileged user, openvt -u can be manipulated into incorrectly attributing the TTY to the privileged owner. This bypasses authentication, allowing the tool to execute a passwordless login, such as login -f root, on the spawned VT. This vulnerability is specifically reachable in deployments using openvt via privileged kbrequest or init paths.

Impact

Successful exploitation allows an unprivileged local user to obtain a root shell or login as another privileged user without credentials. This affects systems where openvt is configured in a privileged execution flow, such as through system initialization scripts or keyboard request handlers.

Recommendation

• Monitor system logs and process execution for openvt commands, specifically those utilizing the -u or -us flags.
• Audit kbrequest and init configurations to identify if openvt is executed with elevated privileges.
• Update util-linux packages to the vendor-provided security patch once available to remediate the authenticate_user() logic flaw.
• Restrict local user access to terminal device nodes where possible to prevent unprivileged processes from maintaining descriptors after session termination.