TL;DR: The kbd package, shipped on virtually every Linux distribution, contains a local privilege escalation in openvt -u. A flaw in how authenticate_user() verifies process ownership lets an unprivileged user trigger a passwordless login -f root on a new virtual terminal. The bug lies in stat() following a symlink to the TTY device node instead of checking the actual process owner.

The kbd package: everywhere you look

Open a terminal on any mainstream Linux system and you are interacting with tools from kbd. The package provides loadkeys, setfont, openvt, deallocvt, and the console keyboard maps that define what pressing each key does in text mode. Debian, Ubuntu, RHEL, Fedora, Arch, Alpine, and SUSE all ship it as a base system component. Conservative estimates put kbd on hundreds of millions of Linux installations worldwide, from servers and desktops to embedded devices and container hosts.

One of its lesser-known utilities is openvt, which opens a virtual terminal and optionally runs a command or login session on it. The -u flag is designed to authenticate the current VT owner and spawn a login as that user. In the documented kbrequest init configuration, openvt -us runs as root during keyboard request events.

What happened

The ownership check inside authenticate_user() calls stat("/proc/<pid>/fd/0") to determine who owns the process currently attached to the virtual terminal. The problem: stat() follows the symlink. The path /proc/<pid>/fd/0 is a symlink pointing to the underlying TTY device node, so buf.st_uid comes back as the owner of the TTY device, not the owner of the process holding that file descriptor.

After a user logs out, the TTY device ownership resets to root or the getty process. If an unprivileged process still has fd 0 attached to that same TTY, the stat() check sees root as the owner and the authentication passes. At that point, the -u code path executes a passwordless login as the authenticated user. In the kbrequest init context running openvt -us, that means login -f root on the spawned virtual terminal.

The escalation requires local access to the system and a configuration that uses openvt -u from a privileged context. The CVE report scopes the claim to the documented kbrequest init deployment and does not assert reachability for other openvt usage patterns.

Who is affected

Any Linux system running the kbd package with the kbrequest init configuration using openvt -us is affected. The vulnerability is local: an attacker needs shell access or the ability to run processes on the target machine with a file descriptor attached to the vulnerable TTY. The CVSS score has not yet been assigned by NVD as of publication. The CVE was disclosed via the CVE List V5 feed on August 11, 2026.

What to do

No fixed version has been announced at the time of writing. Practical mitigations:

• If you do not use kbrequest init entries that invoke openvt -us, the documented escalation path is not reachable in your deployment.
• Restrict local shell access on systems where the kbrequest configuration is active. The attack requires an unprivileged local user with a process attached to the console TTY.
• Monitor for unexpected login -f root process spawns, especially from openvt parent processes.
• Patch kbd as soon as a fixed release becomes available from your distribution's package repository.

Why it matters

Privilege escalation from unprivileged local user to passwordless root is one of the most dangerous escalation classes on Linux. The kbd package's ubiquity means this vulnerability sits on an enormous number of systems, though the attack surface is narrower than the package footprint because the escalation depends on the kbrequest init configuration being active. Systems without that configuration are not affected by the documented path.

The root cause is a classic TOCTOU-style identification failure: stat() resolves a symlink and returns metadata about the symlink target rather than the process that owns the file descriptor. fstat() on the file descriptor directly would have returned the correct process ownership and avoided the bypass entirely.