Is CVE-2026-72693 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72693 being exploited in the wild.

How severe is CVE-2026-72693?

High severity, with a CVSS score of 7.8, published 11 August 2026.

Is there a fix for CVE-2026-72693?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-72693 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-72693?

Check whether you run X.Org Openvt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72693: X.Org openvt privilege escalation via TTY ownership race condition

CVE-2026-72693 · Severity: high · CVSS 7.8 · Published 2026-08-11

openvt is a utility used in X.Org display server environments to open a new virtual terminal and execute a login session. A flaw in the ownership verification logic allows an unprivileged process to be incorrectly identified as the TTY owner, enabling passwordless root login on systems using the documented kbrequest/init deployment. An attacker with local access can exploit this race condition to gain root privileges.

Vendors: X.Org.

Quick answers

Is CVE-2026-72693 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72693 being exploited in the wild.
How severe is CVE-2026-72693?: High severity, with a CVSS score of 7.8, published 11 August 2026.
Which products and versions are affected?: X.Org Openvt <UNKNOWN>.
Is there a fix for CVE-2026-72693?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-72693 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-72693?: Check whether you run X.Org Openvt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation in openvt's `-u` flag implementation, which is designed to identify the current VT owner and execute login as that user from a privileged context. The root cause lies in the `authenticate_user()` function, which uses `stat("/proc/<pid>/fd/0")` to verify ownership. Since stat() follows the symlink to the underlying TTY device node, the returned `st_uid` reflects the TTY device owner rather than the process owner. An attacker can exploit a race condition: if a TTY owner logs out while an unprivileged process still holds a file descriptor to that TTY, and the TTY ownership reverts to root or getty, the ownership check incorrectly treats the unprivileged process as privileged. When using the documented `kbrequest`/init deployment with `openvt -us`, this leads to passwordless `login -f root` execution. The attack requires local access and relies on timing to win the race condition between process cleanup and TTY ownership transitions.

Affected products

X.Org openvt <UNKNOWN>

Timeline

2026-08-11: disclosed: CVE-2026-72693 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.