THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-72693 (HIGH 7.8) — `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd

[NVD] CVE-2026-72693 (HIGH 7.8) — `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd

lownvdPublished 2026-08-11

CVE-2026-72693 CVSS: 7.8 HIGH Published: 2026-08-11T09:17:14.340

`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device n

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72693