Local Privilege Escalation Vulnerability in kbd Package - CVE-2026-72693
Summary
ALSA-2026:57597: Moderate: kbd security update. Affects kbd versions < 2.6.4-8.el10_2. Fixed in 2.6.4-8.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kbd package provides essential tools for managing console behavior on Linux systems, including keyboard settings, screen fonts, virtual terminals, and font files. It is a critical component for system interaction and user interface management. However, the kbd package has been identified to have a security vulnerability that could allow unauthorized users to gain elevated privileges.
Vulnerability Detail
The vulnerability identified as CVE-2026-72693 is a local privilege escalation flaw in the kbd package. This issue arises from incorrect process owner verification in the openvt utility, which can allow an attacker to execute commands as the root user without requiring a password. The implications of this vulnerability are severe, as it could enable unauthorized access to sensitive system functions and data, potentially compromising the entire system's integrity.
How To Fix
Minimum fixed version
2.6.4-8.el10_2
This is the first release that contains the fix.
sudo dnf update kbdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the openvt utility by modifying permissions or using access control lists (ACLs) to limit its execution to trusted users only. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The kbd package vulnerability (CVE-2026-72693) poses a significant risk of local privilege escalation, allowing unauthorized users to gain root access. It is crucial to update the package to the latest version to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for kbd →
FAQ
CVE-2026-72693 is a security vulnerability in the kbd package that allows local privilege escalation due to improper process owner verification.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, consider implementing access controls to limit the execution of the openvt utility as a temporary measure.
Failing to address this vulnerability could lead to unauthorized access and control over the system, potentially resulting in data breaches or system compromise.
More information about the kbd package and its functionalities can be found in the official documentation or the package repository.
Related vulnerabilities
Recent vulnerabilities recorded for kbd.
