CVE-2026-72693

Name of the Vulnerable Software and Affected Versions openvt (affected versions not specified)

Description The openvt -u functionality is designed to identify the owner of the current Virtual Terminal (VT) and execute login as that user from a privileged context. A flaw exists in the authenticate user() function, which uses stat("/proc/<pid>/fd/0") to verify ownership. Because stat() follows the symlink to the underlying TTY device node, the buf.st uid variable reflects the owner of the TTY node instead of the process holding the file descriptor. If an unprivileged process maintains fd 0 attached to a TTY after the owner has logged out and the TTY owner reverts to root or the getty owner, the system may incorrectly identify the process as belonging to the privileged owner. This allows the -u path to perform a passwordless login as the selected user, potentially leading to passwordless login -f root in specific kbrequest/init deployments using openvt -us.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.