Local Privilege Escalation Vulnerability in kbd Package
Summary
ALSA-2026:57610: Moderate: kbd security update. Affects kbd versions < 2.4.0-12.el9_8. Fixed in 2.4.0-12.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kbd package provides essential tools for managing console behavior on Linux systems, including keyboard configurations, screen fonts, virtual terminals, and font files. It is a critical component for system administrators and users who rely on console interfaces for system management. However, a security flaw has been identified that could allow unauthorized users to gain elevated privileges.
Vulnerability Detail
The vulnerability, identified as CVE-2026-72693, arises from incorrect process owner verification in the openvt utility of the kbd package. This flaw enables local privilege escalation, allowing an attacker with local access to execute commands as the root user without requiring a password. The implications of this vulnerability are significant, as it could lead to unauthorized access to sensitive system resources and potential system compromise.
How To Fix
Minimum fixed version
2.4.0-12.el9_8
This is the first release that contains the fix.
sudo dnf update kbdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the openvt utility by modifying permissions or using access control mechanisms to limit its execution to trusted users only. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The kbd package has a critical vulnerability that could allow local privilege escalation, posing significant risks to system security. It is essential to update to the latest patched version to mitigate these risks effectively. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for kbd →
FAQ
The kbd package provides tools for managing console behavior on Linux systems, including keyboard settings and virtual terminal management.
CVE-2026-72693 refers to a security vulnerability in the kbd package that allows local privilege escalation due to incorrect process owner verification.
You can check if your system is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any installation.
Failing to address this vulnerability could allow unauthorized users to gain root access to your system, leading to potential data breaches and system compromise.
While the best course of action is to update the package, you can temporarily restrict access to the openvt utility to trusted users as a workaround.
Related vulnerabilities
Recent vulnerabilities recorded for kbd.
