Local Privilege Escalation Vulnerability in kbd Package: CVE-2026-72693
Summary
RLSA-2026:78951: Moderate: kbd security update. Affects kbd versions < 0:2.0.4-11.el8_10.1. Fixed in 0:2.0.4-11.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kbd package provides essential tools for managing console behavior on Linux systems, including keyboard configurations, screen fonts, virtual terminals, and font files. It is a critical component for system administrators and users who interact with the console interface. The package's functionality is crucial for ensuring proper input and display management in various Linux environments.
Vulnerability Detail
The vulnerability identified as CVE-2026-72693 is a local privilege escalation issue within the kbd package. It arises from incorrect process owner verification in the openvt utility, which can allow an unprivileged user to gain passwordless root access. This flaw can lead to severe security implications, as it enables unauthorized users to execute commands with elevated privileges, potentially compromising the entire system. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
0:2.0.4-11.el8_10.1
This is the first release that contains the fix.
sudo dnf update kbdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the openvt utility by modifying file permissions or using access control mechanisms to prevent unprivileged users from executing it. However, this is not a permanent fix and should only be used until the package is updated.
Conclusion
The kbd package has a critical vulnerability (CVE-2026-72693) that allows local privilege escalation due to improper process owner verification. It is essential to update the package to the latest version to mitigate this risk. Users should also consider temporary workarounds while awaiting updates.
See every vulnerability recorded for kbd →
FAQ
The kbd package provides tools for managing console behavior on Linux systems, including keyboard settings and virtual terminal management.
CVE-2026-72693 refers to a local privilege escalation vulnerability in the kbd package that allows unauthorized users to gain root access.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities like CVE-2026-72693.
If an immediate update is not possible, consider restricting access to the openvt utility as a temporary workaround until the package can be updated.
Exploiting this vulnerability can lead to unauthorized root access, allowing attackers to execute arbitrary commands and compromise system integrity.
Related vulnerabilities
Recent vulnerabilities recorded for kbd.
