{"id":"AZL-95928","summary":"CVE-2026-72693 affecting package kbd 2.2.0-2","details":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.","modified":"2026-08-31T05:26:27Z","published":"2026-08-11T09:17:14Z","upstream":["CVE-2026-72693"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72693"}],"affected":[{"package":{"name":"kbd","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kbd"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.2.0-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95928.json"}}],"schema_version":"1.9.0"}