Loading story…
Red Hat released security updates for the kbd package in RHEL 9 and RHEL 10 to fix CVE-2026-72693, a local privilege escalation flaw in the openvt utility that can lead to passwordless root login. The bug affects the privileged openvt -u login path and stems from incorrect process owner verification: openvt trusted the ownership of the TTY referenced through /proc/<pid>/fd/0 instead of validating the owning process. In vulnerable deployments, including documented kbrequest/init configurations such as kb::kbrequest:/usr/bin/openvt -us, an unprivileged local user could reach login -f root and gain full system compromise.
Red Hat rated the issue Moderate in its advisories RHSA-2026:57597 for RHEL 10 and RHSA-2026:57610 for RHEL 9, while the original report assigned a CVSS 7.8 High score because exploitation requires only local access and a specific privileged configuration. Updated kbd packages were issued across multiple architectures and support channels, including builds such as 2.6.4-8.el10_2 for RHEL 10 and 2.4.0-12.el9_8 for RHEL 9. Downstream coverage also appeared in AlmaLinux 10 detection content, indicating the flaw affects related kbd, kbd-legacy, and kbd-misc packages in compatible enterprise Linux environments.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
The Tenable plugin states that the patch for CVE-2026-72693 was published on August 20, 2026, referencing AlmaLinux advisory ALSA-2026:57597 derived from Red Hat's fix stream.
On 2026-08-20, Red Hat issued RHSA-2026:57610 for Red Hat Enterprise Linux 9, releasing updated kbd packages including version 2.4.0-12.el9_8 to address CVE-2026-72693.
On 2026-08-20, Red Hat issued RHSA-2026:57597 for Red Hat Enterprise Linux 10, releasing updated kbd packages version 2.6.4-8.el10_2 to fix the openvt privilege escalation flaw.
The Tenable plugin states that CVE-2026-72693 was published on August 11, 2026. The vulnerability is a local privilege escalation flaw in openvt that can enable passwordless root login in affected deployments.
A Red Hat Bugzilla report described CVE-2026-72693 as a local privilege escalation in kbd's openvt utility caused by trusting TTY ownership from /proc/<pid>/fd/0 instead of validating the owning process. The report included exploitation details, mitigations, and a proposed code fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026
Red Hat released a series of **Important** and **Critical** kernel security advisories across **RHEL 8, 9, and 10** product lines, including **kernel-rt**, **Extended Update Support**, **SAP**, and **RHEL for NVIDIA**, to remediate multiple Linux kernel vulnerabilities. The updates cover issues such as `CVE-2026-23270`, a use-after-free in traffic control `act_ct` that can cause denial of service and may allow privilege escalation under specific misconfigurations; `CVE-2026-31419`, a bonding driver race condition that can trigger a use-after-free and kernel crash; `CVE-2026-31402`, a heap overflow in the NFSv4.0 LOCK replay cache that can be triggered remotely by unauthenticated attackers; and `CVE-2026-31431` in `crypto: algif_aead`, alongside several other kernel flaws affecting networking, storage, virtualization, and memory handling. Advisories including **RHSA-2026:13566**, **RHSA-2026:14137**, **RHSA-2026:22334**, **RHSA-2026:27354**, and **RHSA-2026:33486** show the fixes were distributed across standard and specialized kernels for x86_64, aarch64, s390x, and ppc64le systems. Red Hat said some updates also address local privilege-escalation bugs such as **Dirty Frag** and **Fragnesia**, as well as kernel panic conditions in real-time builds. Affected environments include Real Time Linux, NFV, SAP-focused deployments, and NVIDIA-enabled RHEL 10 systems, and Red Hat instructed customers to install the updated kernel packages and **reboot** for the protections to take effect.
Aug 25, 2026
Red Hat disclosed **CVE-2026-46331**, an important local privilege escalation vulnerability in the Linux kernel’s traffic control subsystem, specifically the `act_pedit` module. The flaw stems from a missing bounds check in `tcf_pedit_act()` that can lead to an out-of-bounds write and page cache memory corruption, potentially allowing a local user to gain **root** privileges. Red Hat said **RHEL 8, 9, and 10** are directly affected, along with **Red Hat Enterprise Linux for NVIDIA** and **Red Hat OpenShift Container Platform**, though OpenShift exposure is considered low because the vulnerable module is not loaded by default. Technical details show the bug arises when packet-editing keys recompute Layer 4 offsets during processing, allowing an earlier mutation to influence a later write beyond the originally validated writable packet range. Red Hat has issued fixes across multiple product lines, including RHEL variants, SAP Solutions, Telecommunications Update Service, Extended Update Support, Advanced Mission Critical Update Support, and NVIDIA for RHEL 10, while warning that products built on the RHEL kernel such as **RHEL CoreOS**, **Red Hat OpenStack Platform**, and **Red Hat Virtualization** may also be impacted. As a mitigation, Red Hat advised administrators to blacklist the `act_pedit` kernel module and verify whether it is loaded before unloading it or rebooting.
Aug 25, 2026