OESA-2026-3505

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3505
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3505.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3505
Upstream
  • CVE-2026-72693
Published
2026-08-30T04:14:24Z
Modified
2026-08-30T04:31:43Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
kbd security update
Details

The project contains tools for managing Linux console ,including Linux console,virtual terminals, keyboard, etc, mainly, what they do is loading console fonts and keyboard maps.

Security Fix(es):

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticate_user() relies on stat("/proc/<pid>/fd/0"). stat() on /proc/<pid>/fd/0 follows the symlink to the underlying TTY device node. As a result, buf.st_uid reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to root or the getty owner after logout while an unprivileged process still has fd 0 attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the -u path executes a passwordless login as the selected user. In the documented kbrequest/init deployment using openvt -us, this can result in passwordless login -f root on the spawned VT.(CVE-2026-72693)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP4
kbd

Package

Name
kbd
Purl
pkg:rpm/openEuler/kbd&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.0-4.oe2003sp4

Ecosystem specific 

{
    "aarch64": [
        "kbd-2.2.0-4.oe2003sp4.aarch64.rpm",
        "kbd-debuginfo-2.2.0-4.oe2003sp4.aarch64.rpm",
        "kbd-debugsource-2.2.0-4.oe2003sp4.aarch64.rpm"
    ],
    "noarch": [
        "kbd-help-2.2.0-4.oe2003sp4.noarch.rpm",
        "kbd-legacy-2.2.0-4.oe2003sp4.noarch.rpm",
        "kbd-misc-2.2.0-4.oe2003sp4.noarch.rpm"
    ],
    "src": [
        "kbd-2.2.0-4.oe2003sp4.src.rpm"
    ],
    "x86_64": [
        "kbd-2.2.0-4.oe2003sp4.x86_64.rpm",
        "kbd-debuginfo-2.2.0-4.oe2003sp4.x86_64.rpm",
        "kbd-debugsource-2.2.0-4.oe2003sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3505.json"
openEuler:22.03-LTS-SP4
kbd

Package

Name
kbd
Purl
pkg:rpm/openEuler/kbd&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.5.1-3.oe2203sp4

Ecosystem specific 

{
    "aarch64": [
        "kbd-2.5.1-3.oe2203sp4.aarch64.rpm",
        "kbd-debuginfo-2.5.1-3.oe2203sp4.aarch64.rpm",
        "kbd-debugsource-2.5.1-3.oe2203sp4.aarch64.rpm"
    ],
    "noarch": [
        "kbd-help-2.5.1-3.oe2203sp4.noarch.rpm",
        "kbd-legacy-2.5.1-3.oe2203sp4.noarch.rpm",
        "kbd-misc-2.5.1-3.oe2203sp4.noarch.rpm"
    ],
    "src": [
        "kbd-2.5.1-3.oe2203sp4.src.rpm"
    ],
    "x86_64": [
        "kbd-2.5.1-3.oe2203sp4.x86_64.rpm",
        "kbd-debuginfo-2.5.1-3.oe2203sp4.x86_64.rpm",
        "kbd-debugsource-2.5.1-3.oe2203sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3505.json"
openEuler:24.03-LTS-SP1
kbd

Package

Name
kbd
Purl
pkg:rpm/openEuler/kbd&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.1-3.oe2403sp1

Ecosystem specific 

{
    "aarch64": [
        "kbd-2.6.1-3.oe2403sp1.aarch64.rpm",
        "kbd-debuginfo-2.6.1-3.oe2403sp1.aarch64.rpm",
        "kbd-debugsource-2.6.1-3.oe2403sp1.aarch64.rpm"
    ],
    "noarch": [
        "kbd-help-2.6.1-3.oe2403sp1.noarch.rpm",
        "kbd-legacy-2.6.1-3.oe2403sp1.noarch.rpm",
        "kbd-misc-2.6.1-3.oe2403sp1.noarch.rpm"
    ],
    "src": [
        "kbd-2.6.1-3.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "kbd-2.6.1-3.oe2403sp1.x86_64.rpm",
        "kbd-debuginfo-2.6.1-3.oe2403sp1.x86_64.rpm",
        "kbd-debugsource-2.6.1-3.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3505.json"
openEuler:24.03-LTS-SP3
kbd

Package

Name
kbd
Purl
pkg:rpm/openEuler/kbd&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.1-3.oe2403sp3

Ecosystem specific 

{
    "aarch64": [
        "kbd-2.6.1-3.oe2403sp3.aarch64.rpm",
        "kbd-debuginfo-2.6.1-3.oe2403sp3.aarch64.rpm",
        "kbd-debugsource-2.6.1-3.oe2403sp3.aarch64.rpm"
    ],
    "noarch": [
        "kbd-help-2.6.1-3.oe2403sp3.noarch.rpm",
        "kbd-legacy-2.6.1-3.oe2403sp3.noarch.rpm",
        "kbd-misc-2.6.1-3.oe2403sp3.noarch.rpm"
    ],
    "src": [
        "kbd-2.6.1-3.oe2403sp3.src.rpm"
    ],
    "x86_64": [
        "kbd-2.6.1-3.oe2403sp3.x86_64.rpm",
        "kbd-debuginfo-2.6.1-3.oe2403sp3.x86_64.rpm",
        "kbd-debugsource-2.6.1-3.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3505.json"
openEuler:24.03-LTS-SP4
kbd

Package

Name
kbd
Purl
pkg:rpm/openEuler/kbd&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.1-3.oe2403sp4

Ecosystem specific 

{
    "aarch64": [
        "kbd-2.6.1-3.oe2403sp4.aarch64.rpm",
        "kbd-debuginfo-2.6.1-3.oe2403sp4.aarch64.rpm",
        "kbd-debugsource-2.6.1-3.oe2403sp4.aarch64.rpm"
    ],
    "noarch": [
        "kbd-help-2.6.1-3.oe2403sp4.noarch.rpm",
        "kbd-legacy-2.6.1-3.oe2403sp4.noarch.rpm",
        "kbd-misc-2.6.1-3.oe2403sp4.noarch.rpm"
    ],
    "src": [
        "kbd-2.6.1-3.oe2403sp4.src.rpm"
    ],
    "x86_64": [
        "kbd-2.6.1-3.oe2403sp4.x86_64.rpm",
        "kbd-debuginfo-2.6.1-3.oe2403sp4.x86_64.rpm",
        "kbd-debugsource-2.6.1-3.oe2403sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3505.json"