Executive brief
openvt is a utility used in X.Org display server environments to open a new virtual terminal and execute a login session. A flaw in the ownership verification logic allows an unprivileged process to be incorrectly identified as the TTY owner, enabling passwordless root login on systems using the documented kbrequest/init deployment. An attacker with local access can exploit this race condition to gain root privileges.
Technical details
The vulnerability is a privilege escalation in openvt's `-u` flag implementation, which is designed to identify the current VT owner and execute login as that user from a privileged context. The root cause lies in the `authenticate_user()` function, which uses `stat("/proc/<pid>/fd/0")` to verify ownership. Since stat() follows the symlink to the underlying TTY device node, the returned `st_uid` reflects the TTY device owner rather than the process owner. An attacker can exploit a race condition: if a TTY owner logs out while an unprivileged process still holds a file descriptor to that TTY, and the TTY ownership reverts to root or getty, the ownership check incorrectly treats the unprivileged process as privileged. When using the documented `kbrequest`/init deployment with `openvt -us`, this leads to passwordless `login -f root` execution. The attack requires local access and relies on timing to win the race condition between process cleanup and TTY ownership transitions.
Affected products
- X.Org openvt <UNKNOWN>
Timeline
- 2026-08-11: disclosed: CVE-2026-72693 published