# CVE-2026-72693: X.Org openvt privilege escalation via TTY ownership race condition

Source: https://junglewise.ai/threats/cve-2026-72693-x-org-openvt-privilege-escalation-via-tty-ownership-race  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72693 · Severity: high · CVSS 7.8 · Published 2026-08-11

openvt is a utility used in X.Org display server environments to open a new virtual terminal and execute a login session. A flaw in the ownership verification logic allows an unprivileged process to be incorrectly identified as the TTY owner, enabling passwordless root login on systems using the documented kbrequest/init deployment. An attacker with local access can exploit this race condition to gain root privileges.

Vendors: [X.Org](https://junglewise.ai/threats/vendors/x-org).

## Quick answers

**Is CVE-2026-72693 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72693 being exploited in the wild.

**How severe is CVE-2026-72693?** High severity, with a CVSS score of 7.8, published 11 August 2026.

**Which products and versions are affected?** X.Org Openvt <UNKNOWN>.

**Is there a fix for CVE-2026-72693?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-72693 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-72693?** Check whether you run X.Org Openvt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation in openvt's `-u` flag implementation, which is designed to identify the current VT owner and execute login as that user from a privileged context. The root cause lies in the `authenticate_user()` function, which uses `stat("/proc/<pid>/fd/0")` to verify ownership. Since stat() follows the symlink to the underlying TTY device node, the returned `st_uid` reflects the TTY device owner rather than the process owner. An attacker can exploit a race condition: if a TTY owner logs out while an unprivileged process still holds a file descriptor to that TTY, and the TTY ownership reverts to root or getty, the ownership check incorrectly treats the unprivileged process as privileged. When using the documented `kbrequest`/init deployment with `openvt -us`, this leads to passwordless `login -f root` execution. The attack requires local access and relies on timing to win the race condition between process cleanup and TTY ownership transitions.

## Affected products

- X.Org openvt <UNKNOWN>

## Timeline

- 2026-08-11: disclosed: CVE-2026-72693 published

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)