UBUNTU-CVE-2026-72693

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-72693
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-72693.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-72693
Upstream
  • CVE-2026-72693
Published
2026-08-13T00:00:00Z
Modified
2026-08-13T19:30:11.854146399Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticate_user() relies on stat("/proc/<pid>/fd/0"). stat() on /proc/<pid>/fd/0 follows the symlink to the underlying TTY device node. As a result, buf.st_uid reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to root or the getty owner after logout while an unprivileged process still has fd 0 attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the -u path executes a passwordless login as the selected user. In the documented kbrequest/init deployment using openvt -us, this can result in passwordless login -f root on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use openvt -u from a privileged kbrequest/init path.

References

Affected packages

Ubuntu:14.04:LTS
kbd

Package

Name
kbd
Purl
pkg:deb/ubuntu/kbd?arch=source&distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.15.5-1ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.15.5-1ubuntu1",
            "binary_name": "kbd"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-72693.json"
Ubuntu:16.04:LTS
kbd

Package

Name
kbd
Purl
pkg:deb/ubuntu/kbd?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.15.5-1ubuntu4
1.15.5-1ubuntu5

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.15.5-1ubuntu5",
            "binary_name": "kbd"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-72693.json"
Ubuntu:18.04:LTS
kbd

Package

Name
kbd
Purl
pkg:deb/ubuntu/kbd?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.3-2ubuntu3
2.0.4-2ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.0.4-2ubuntu1",
            "binary_name": "kbd"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-72693.json"
Ubuntu:20.04:LTS
kbd

Package

Name
kbd
Purl
pkg:deb/ubuntu/kbd?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.4-4ubuntu2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.0.4-4ubuntu2",
            "binary_name": "kbd"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-72693.json"
Ubuntu:22.04:LTS
kbd

Package

Name
kbd
Purl
pkg:deb/ubuntu/kbd?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.3.0-3ubuntu3
2.3.0-3ubuntu4
2.3.0-3ubuntu4.22.04

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.3.0-3ubuntu4.22.04",
            "binary_name": "kbd"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-72693.json"
Ubuntu:24.04:LTS
kbd

Package

Name
kbd
Purl
pkg:deb/ubuntu/kbd?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.5.1-1ubuntu1
2.6.4-2ubuntu1
2.6.4-2ubuntu2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.6.4-2ubuntu2",
            "binary_name": "kbd"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-72693.json"
Ubuntu:26.04:LTS
kbd

Package

Name
kbd
Purl
pkg:deb/ubuntu/kbd?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.7.1-2ubuntu1
2.7.1-2ubuntu2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.7.1-2ubuntu2",
            "binary_name": "kbd"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-72693.json"