PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72693 Red Hat CVE debrief

The `openvt -u` command is intended to identify the owner of the current VT and execute `login` as that user from a privileged context. However, due to a flaw in the ownership test in `authenticate_user()`, an unprivileged process can bypass this check if it has file descriptor 0 attached to a TTY previously owned by the privileged console owner. This can lead to a local privilege escalation vulnerability, particularly in Red Hat-based systems where `openvt -u` is used from a privileged context. The vulnerability allows for passwordless `login -f root` on the spawned VT. Evidence is based on limited details from Red Hat security advisories and a Bugzilla report, indicating a need for further verification and patching. Affected systems may be vulnerable to local privilege escalation attacks if not properly patched. Review and apply patches from Red Hat for affected systems, use secure login practices, monitor system logs for suspicious activity, and limit use of `openvt -u` to necessary users and contexts.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-11
Original CVE updated
2026-08-24
Advisory published
2026-08-11
Advisory updated
2026-08-24

Who should care

System administrators using `openvt -u` in a privileged context, especially in Red Hat-based systems, should review and apply patches to mitigate this vulnerability. Additionally, security teams and vulnerability management teams should be aware of the potential risks and ensure that proper mitigations are in place. Operators and platform administrators should also review system configurations and logs for potential suspicious activity related to `openvt -u` usage.

Technical summary

The `openvt -u` command can be used to execute a passwordless login as the owner of the current VT. However, the ownership test in `authenticate_user()` can be bypassed if an unprivileged process has file descriptor 0 attached to a TTY that was previously owned by the privileged console owner. This can lead to a local privilege escalation vulnerability. The vulnerability is particularly relevant in Red Hat-based systems where `openvt -u` is used from a privileged context. Affected systems may be vulnerable to local privilege escalation attacks if not properly patched.

Defensive priority

This vulnerability allows for local privilege escalation. Systems using `openvt -u` from a privileged context may be vulnerable. Immediate review and patching are recommended.

Recommended defensive actions

  • Review and apply patches from Red Hat for affected systems
  • Use secure login practices and monitor system logs for suspicious activity
  • Limit use of `openvt -u` to necessary users and contexts
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence is based on limited details from Red Hat security advisories and a Bugzilla report. Further verification is needed to fully understand the vulnerability's impact and affected systems. The CVE record was published on 2026-08-11T09:17:14.340Z and has not been modified since then. Additional review of system logs and monitoring for suspicious activity related to `openvt -u` usage is recommended. Limited information is available about potential exploits or attacks; defenders should focus on verifying system configurations and applying patches.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-11T09:17:14.340Z and has not been modified since then.