[OE-core][wrynose][patch] kbd: Fix CVE-2026-72693

[OE-core][wrynose][patch] kbd: Fix CVE-2026-72693

[Vijay Anusuri]

Pick patch according to [1]

[1] https://security-tracker.debian.org/tracker/CVE-2026-72693
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-72693
[3] https://access.redhat.com/security/cve/cve-2026-72693

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 .../recipes-core/kbd/kbd/CVE-2026-72693.patch | 155 ++++++++++++++++++
 meta/recipes-core/kbd/kbd_2.9.0.bb            |   1 +
 2 files changed, 156 insertions(+)
 create mode 100644 meta/recipes-core/kbd/kbd/CVE-2026-72693.patch

diff --git a/meta/recipes-core/kbd/kbd/CVE-2026-72693.patch b/meta/recipes-core/kbd/kbd/CVE-2026-72693.patch
new file mode 100644
index 0000000000..06b8c195a5
--- /dev/null
+++ b/meta/recipes-core/kbd/kbd/CVE-2026-72693.patch
@@ -0,0 +1,155 @@
+From 78d5ae119742e87baa7dbe0f5c4107e7533fd698 Mon Sep 17 00:00:00 2001
+From: Alexey Gladkov <legion@kernel.org>
+Date: Tue, 12 May 2026 10:20:50 +0200
+Subject: [PATCH] openvt: make -u process matching more conservative
+
+The -u mode relies on the current VT owner to decide which user should
+be used for the new login session. Make that check stricter by requiring
+a matching process owner and controlling terminal instead of relying on
+the ownership of an inherited file descriptor.
+
+Also reject root as a pre-authenticated target and document the tighter
+behavior in the man page.
+
+Signed-off-by: Alexey Gladkov <legion@kernel.org>
+
+Upstream-Status: Backport [https://github.com/legionus/kbd/commit/78d5ae119742e87baa7dbe0f5c4107e7533fd698]
+CVE: CVE-2026-72693
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ docs/man/man1/openvt.1 | 10 +++++++
+ src/openvt.c           | 64 +++++++++++++++++++++++++++++++++++++-----
+ 2 files changed, 67 insertions(+), 7 deletions(-)
+
+diff --git a/docs/man/man1/openvt.1 b/docs/man/man1/openvt.1
+index 8f1244f..404e4a0 100644
+--- a/docs/man/man1/openvt.1
++++ b/docs/man/man1/openvt.1
+@@ -36,6 +36,8 @@ will be made the new current VT.
+ \fB\-u\fR, \fB\-\-user\fR
+ Figure out the owner of the current VT, and run login as that user.
+ Suitable to be called by init. Shouldn't be used with \fI\-c\fR or \fI\-l\fR.
++This option refuses to pre-authenticate root and requires a process owned by
++the VT owner whose controlling terminal is the current VT.
+ .TP
+ \fB\-l\fR, \fB\-\-login\fR
+ Make the command a login shell. A \- is prepended to the name of the command
+@@ -64,6 +66,14 @@ If
+ is compiled with a getopt_long() and you wish to set
+ options to the command to be run, then you must supply
+ the end of options \-\- flag before the command.
++.PP
++The
++.B \-u
++option uses
++.BR "login -f"
++and therefore bypasses normal password authentication for the detected user.
++It is intended only for controlled init or keyboard-request configurations.
++Use a normal authenticated login command when authentication is required.
+ .SH EXAMPLES
+ .B openvt
+ can be used to start a shell on the next free VT, by using the command:
+diff --git a/src/openvt.c b/src/openvt.c
+index a94392b..ddd9239 100644
+--- a/src/openvt.c
++++ b/src/openvt.c
+@@ -57,6 +57,51 @@ usage(int rc, const struct kbd_help *options)
+ 	exit(rc);
+ }
+ 
++static int
++proc_pid_stat(const char *pid, uid_t *uid, dev_t *tty)
++{
++	char filename[NAME_MAX + 12];
++	char line[BUFSIZ];
++	char *lp, *rp;
++	FILE *fp;
++	struct stat st;
++	long tty_nr;
++
++	snprintf(filename, sizeof(filename), "/proc/%s/stat", pid);
++	fp = fopen(filename, "r");
++	if (!fp)
++		return -1;
++
++	if (fstat(fileno(fp), &st)) {
++		fclose(fp);
++		return -1;
++	}
++
++	if (!fgets(line, sizeof(line), fp)) {
++		fclose(fp);
++		return -1;
++	}
++	fclose(fp);
++
++	rp = strrchr(line, ')');
++	if (!rp)
++		return -1;
++
++	/*
++	 * /proc/<pid>/stat fields after comm are:
++	 * state ppid pgrp session tty_nr ...
++	 */
++	if (!rp || sscanf(rp + 1, " %*c %*d %*d %*d %ld", &tty_nr) != 1)
++		return -1;
++
++	if (tty_nr <= 0)
++		return -1;
++
++	*uid = st.st_uid;
++	*tty = (dev_t) tty_nr;
++	return 0;
++}
++
+ /*
+  * Support for Spawn_Console: openvt running from init
+  * added by Joshua Spoerri, Thu Jul 18 21:13:16 EDT 1996
+@@ -88,8 +133,7 @@ authenticate_user(int curvt)
+ 	DIR *dp;
+ 	struct dirent *dentp;
+ 	struct stat buf;
+-	dev_t console_dev;
+-	ino_t console_ino;
++	dev_t console_rdev;
+ 	uid_t console_uid;
+ 	char filename[NAME_MAX + 12];
+ 	struct passwd *pwnam;
+@@ -109,10 +153,12 @@ authenticate_user(int curvt)
+ 			kbd_error(EXIT_FAILURE, errsv, "%s", filename);
+ 		}
+ 	}
+-	console_dev = buf.st_dev;
+-	console_ino = buf.st_ino;
++	console_rdev = buf.st_rdev;
+ 	console_uid = buf.st_uid;
+ 
++	if (console_uid == 0)
++		kbd_error(EXIT_FAILURE, 0, _("Refusing to pre-authenticate root on current tty."));
++
+ 	/* get the owner of current tty */
+ 	if (!(pwnam = getpwuid(console_uid)))
+ 		kbd_error(EXIT_FAILURE, errno, "getpwuid");
+@@ -120,12 +166,16 @@ authenticate_user(int curvt)
+ 	/* check to make sure that user has a process on that tty */
+ 	/* this will fail for example when X is running on the tty */
+ 	while ((dentp = readdir(dp))) {
+-		sprintf(filename, "/proc/%s/fd/0", dentp->d_name);
++		uid_t proc_uid;
++		dev_t proc_tty;
++
++		if (dentp->d_name[0] < '0' || dentp->d_name[0] > '9')
++			continue;
+ 
+-		if (stat(filename, &buf))
++		if (proc_pid_stat(dentp->d_name, &proc_uid, &proc_tty) < 0)
+ 			continue;
+ 
+-		if (buf.st_dev == console_dev && buf.st_ino == console_ino && buf.st_uid == console_uid)
++		if (proc_uid == console_uid && proc_tty == console_rdev)
+ 			goto got_a_process;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/meta/recipes-core/kbd/kbd_2.9.0.bb b/meta/recipes-core/kbd/kbd_2.9.0.bb
index 79b011e529..06341ba8c0 100644
--- a/meta/recipes-core/kbd/kbd_2.9.0.bb
+++ b/meta/recipes-core/kbd/kbd_2.9.0.bb
@@ -26,6 +26,7 @@ RCONFLICTS:${PN} = "console-tools"
 SRC_URI = "${KERNELORG_MIRROR}/linux/utils/${BPN}/${BP}.tar.xz \
            file://0001-Preserve-only-necessary-metadata-during-install.patch \
            file://0001-libkbdfile-Fix-problem-with-undeclared-sym_gzopen.patch \
+           file://CVE-2026-72693.patch \
            "
 
 SRC_URI[sha256sum] = "fb3197f17a99eb44d22a3a1a71f755f9622dd963e66acfdea1a45120951b02ed"
-- 
2.43.0

Re: [OE-core][wrynose][patch] kbd: Fix CVE-2026-72693

[Yoann Congal]

On Wed Aug 26, 2026 at 10:13 AM CEST, Vijay Anusuri via lists.openembedded.org wrote:
> Pick patch according to [1]
>
> [1] https://security-tracker.debian.org/tracker/CVE-2026-72693
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-72693
> [3] https://access.redhat.com/security/cve/cve-2026-72693
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
>  .../recipes-core/kbd/kbd/CVE-2026-72693.patch | 155 ++++++++++++++++++
>  meta/recipes-core/kbd/kbd_2.9.0.bb            |   1 +
>  2 files changed, 156 insertions(+)
>  create mode 100644 meta/recipes-core/kbd/kbd/CVE-2026-72693.patch
>
> diff --git a/meta/recipes-core/kbd/kbd/CVE-2026-72693.patch b/meta/recipes-core/kbd/kbd/CVE-2026-72693.patch
> new file mode 100644
> index 0000000000..06b8c195a5
> --- /dev/null
> +++ b/meta/recipes-core/kbd/kbd/CVE-2026-72693.patch
> @@ -0,0 +1,155 @@
> +From 78d5ae119742e87baa7dbe0f5c4107e7533fd698 Mon Sep 17 00:00:00 2001
> +From: Alexey Gladkov <legion@kernel.org>
> +Date: Tue, 12 May 2026 10:20:50 +0200
> +Subject: [PATCH] openvt: make -u process matching more conservative
> +
> +The -u mode relies on the current VT owner to decide which user should
> +be used for the new login session. Make that check stricter by requiring
> +a matching process owner and controlling terminal instead of relying on
> +the ownership of an inherited file descriptor.
> +
> +Also reject root as a pre-authenticated target and document the tighter
> +behavior in the man page.
> +
> +Signed-off-by: Alexey Gladkov <legion@kernel.org>
> +
> +Upstream-Status: Backport [https://github.com/legionus/kbd/commit/78d5ae119742e87baa7dbe0f5c4107e7533fd698]
> +CVE: CVE-2026-72693
> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> +---
> + docs/man/man1/openvt.1 | 10 +++++++
> + src/openvt.c           | 64 +++++++++++++++++++++++++++++++++++++-----
> + 2 files changed, 67 insertions(+), 7 deletions(-)
> +
> +diff --git a/docs/man/man1/openvt.1 b/docs/man/man1/openvt.1
> +index 8f1244f..404e4a0 100644
> +--- a/docs/man/man1/openvt.1
> ++++ b/docs/man/man1/openvt.1
> +@@ -36,6 +36,8 @@ will be made the new current VT.
> + \fB\-u\fR, \fB\-\-user\fR
> + Figure out the owner of the current VT, and run login as that user.
> + Suitable to be called by init. Shouldn't be used with \fI\-c\fR or \fI\-l\fR.
> ++This option refuses to pre-authenticate root and requires a process owned by
> ++the VT owner whose controlling terminal is the current VT.
> + .TP
> + \fB\-l\fR, \fB\-\-login\fR
> + Make the command a login shell. A \- is prepended to the name of the command
> +@@ -64,6 +66,14 @@ If
> + is compiled with a getopt_long() and you wish to set
> + options to the command to be run, then you must supply
> + the end of options \-\- flag before the command.
> ++.PP
> ++The
> ++.B \-u
> ++option uses
> ++.BR "login -f"
> ++and therefore bypasses normal password authentication for the detected user.
> ++It is intended only for controlled init or keyboard-request configurations.
> ++Use a normal authenticated login command when authentication is required.
> + .SH EXAMPLES
> + .B openvt
> + can be used to start a shell on the next free VT, by using the command:
> +diff --git a/src/openvt.c b/src/openvt.c
> +index a94392b..ddd9239 100644
> +--- a/src/openvt.c
> ++++ b/src/openvt.c
> +@@ -57,6 +57,51 @@ usage(int rc, const struct kbd_help *options)
> + 	exit(rc);
> + }
> + 
> ++static int
> ++proc_pid_stat(const char *pid, uid_t *uid, dev_t *tty)
> ++{
> ++	char filename[NAME_MAX + 12];
> ++	char line[BUFSIZ];
> ++	char *lp, *rp;
> ++	FILE *fp;
> ++	struct stat st;
> ++	long tty_nr;
> ++
> ++	snprintf(filename, sizeof(filename), "/proc/%s/stat", pid);
> ++	fp = fopen(filename, "r");
> ++	if (!fp)
> ++		return -1;
> ++
> ++	if (fstat(fileno(fp), &st)) {
> ++		fclose(fp);
> ++		return -1;
> ++	}
> ++
> ++	if (!fgets(line, sizeof(line), fp)) {
> ++		fclose(fp);
> ++		return -1;
> ++	}
> ++	fclose(fp);
> ++
> ++	rp = strrchr(line, ')');
> ++	if (!rp)
> ++		return -1;
> ++
> ++	/*
> ++	 * /proc/<pid>/stat fields after comm are:
> ++	 * state ppid pgrp session tty_nr ...
> ++	 */
> ++	if (!rp || sscanf(rp + 1, " %*c %*d %*d %*d %ld", &tty_nr) != 1)
> ++		return -1;
> ++
> ++	if (tty_nr <= 0)
> ++		return -1;
> ++
> ++	*uid = st.st_uid;
> ++	*tty = (dev_t) tty_nr;
> ++	return 0;
> ++}
> ++
> + /*
> +  * Support for Spawn_Console: openvt running from init
> +  * added by Joshua Spoerri, Thu Jul 18 21:13:16 EDT 1996
> +@@ -88,8 +133,7 @@ authenticate_user(int curvt)
> + 	DIR *dp;
> + 	struct dirent *dentp;
> + 	struct stat buf;
> +-	dev_t console_dev;
> +-	ino_t console_ino;
> ++	dev_t console_rdev;
> + 	uid_t console_uid;
> + 	char filename[NAME_MAX + 12];
> + 	struct passwd *pwnam;
> +@@ -109,10 +153,12 @@ authenticate_user(int curvt)
> + 			kbd_error(EXIT_FAILURE, errsv, "%s", filename);
> + 		}
> + 	}
> +-	console_dev = buf.st_dev;
> +-	console_ino = buf.st_ino;
> ++	console_rdev = buf.st_rdev;
> + 	console_uid = buf.st_uid;
> + 
> ++	if (console_uid == 0)
> ++		kbd_error(EXIT_FAILURE, 0, _("Refusing to pre-authenticate root on current tty."));

Hello,

Isn't this a change in befavior that might break some use-case?
I don't know how legitimate and/or unsafe it is though...
Do you know?

I'll hold this in the meantime.

Regards,
-- 
Yoann Congal
Smile ECS

Re: [OE-core][wrynose][patch] kbd: Fix CVE-2026-72693

[Vijay Anusuri]

[-- Attachment #1: Type: text/plain, Size: 7275 bytes --]

Hi Yoann,

Thanks for reviewing the patch.

Yes, the fix intentionally makes the process matching in openvt -u more
restrictive. The upstream change updates the matching logic so that both of
the following conditions are satisfied:

   - The process owner matches the current VT owner.
   - The process has the current VT as its controlling terminal.

It also prevents root from being selected as the pre-authenticated target.

This behavior change is intended to address the security issue in the
previous implementation, where an unprivileged process holding an inherited
file descriptor for the VT could potentially be incorrectly identified as
the VT owner. In certain privileged kbrequest/init configurations, this
could lead to passwordless root login.

I also checked how this CVE has been handled downstream. Redhat & Oracle
Linux has backported the same fix to kbd 2.4.0 and 2.6.4 .

I agree that this changes the behavior of openvt -u. However, the change
appears to be directly related to preventing the privilege escalation
rather than being an unrelated behavioral change.

Thanks & Regards,

Vijay


On Tue, Sep 8, 2026 at 7:49 PM Yoann Congal <yoann.congal@smile.fr> wrote:

> On Wed Aug 26, 2026 at 10:13 AM CEST, Vijay Anusuri via
> lists.openembedded.org wrote:
> > Pick patch according to [1]
> >
> > [1] https://security-tracker.debian.org/tracker/CVE-2026-72693
> > [2] https://nvd.nist.gov/vuln/detail/CVE-2026-72693
> > [3] https://access.redhat.com/security/cve/cve-2026-72693
> >
> > Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > ---
> >  .../recipes-core/kbd/kbd/CVE-2026-72693.patch | 155 ++++++++++++++++++
> >  meta/recipes-core/kbd/kbd_2.9.0.bb            |   1 +
> >  2 files changed, 156 insertions(+)
> >  create mode 100644 meta/recipes-core/kbd/kbd/CVE-2026-72693.patch
> >
> > diff --git a/meta/recipes-core/kbd/kbd/CVE-2026-72693.patch
> b/meta/recipes-core/kbd/kbd/CVE-2026-72693.patch
> > new file mode 100644
> > index 0000000000..06b8c195a5
> > --- /dev/null
> > +++ b/meta/recipes-core/kbd/kbd/CVE-2026-72693.patch
> > @@ -0,0 +1,155 @@
> > +From 78d5ae119742e87baa7dbe0f5c4107e7533fd698 Mon Sep 17 00:00:00 2001
> > +From: Alexey Gladkov <legion@kernel.org>
> > +Date: Tue, 12 May 2026 10:20:50 +0200
> > +Subject: [PATCH] openvt: make -u process matching more conservative
> > +
> > +The -u mode relies on the current VT owner to decide which user should
> > +be used for the new login session. Make that check stricter by requiring
> > +a matching process owner and controlling terminal instead of relying on
> > +the ownership of an inherited file descriptor.
> > +
> > +Also reject root as a pre-authenticated target and document the tighter
> > +behavior in the man page.
> > +
> > +Signed-off-by: Alexey Gladkov <legion@kernel.org>
> > +
> > +Upstream-Status: Backport [
> https://github.com/legionus/kbd/commit/78d5ae119742e87baa7dbe0f5c4107e7533fd698
> ]
> > +CVE: CVE-2026-72693
> > +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > +---
> > + docs/man/man1/openvt.1 | 10 +++++++
> > + src/openvt.c           | 64 +++++++++++++++++++++++++++++++++++++-----
> > + 2 files changed, 67 insertions(+), 7 deletions(-)
> > +
> > +diff --git a/docs/man/man1/openvt.1 b/docs/man/man1/openvt.1
> > +index 8f1244f..404e4a0 100644
> > +--- a/docs/man/man1/openvt.1
> > ++++ b/docs/man/man1/openvt.1
> > +@@ -36,6 +36,8 @@ will be made the new current VT.
> > + \fB\-u\fR, \fB\-\-user\fR
> > + Figure out the owner of the current VT, and run login as that user.
> > + Suitable to be called by init. Shouldn't be used with \fI\-c\fR or
> \fI\-l\fR.
> > ++This option refuses to pre-authenticate root and requires a process
> owned by
> > ++the VT owner whose controlling terminal is the current VT.
> > + .TP
> > + \fB\-l\fR, \fB\-\-login\fR
> > + Make the command a login shell. A \- is prepended to the name of the
> command
> > +@@ -64,6 +66,14 @@ If
> > + is compiled with a getopt_long() and you wish to set
> > + options to the command to be run, then you must supply
> > + the end of options \-\- flag before the command.
> > ++.PP
> > ++The
> > ++.B \-u
> > ++option uses
> > ++.BR "login -f"
> > ++and therefore bypasses normal password authentication for the detected
> user.
> > ++It is intended only for controlled init or keyboard-request
> configurations.
> > ++Use a normal authenticated login command when authentication is
> required.
> > + .SH EXAMPLES
> > + .B openvt
> > + can be used to start a shell on the next free VT, by using the command:
> > +diff --git a/src/openvt.c b/src/openvt.c
> > +index a94392b..ddd9239 100644
> > +--- a/src/openvt.c
> > ++++ b/src/openvt.c
> > +@@ -57,6 +57,51 @@ usage(int rc, const struct kbd_help *options)
> > +     exit(rc);
> > + }
> > +
> > ++static int
> > ++proc_pid_stat(const char *pid, uid_t *uid, dev_t *tty)
> > ++{
> > ++    char filename[NAME_MAX + 12];
> > ++    char line[BUFSIZ];
> > ++    char *lp, *rp;
> > ++    FILE *fp;
> > ++    struct stat st;
> > ++    long tty_nr;
> > ++
> > ++    snprintf(filename, sizeof(filename), "/proc/%s/stat", pid);
> > ++    fp = fopen(filename, "r");
> > ++    if (!fp)
> > ++            return -1;
> > ++
> > ++    if (fstat(fileno(fp), &st)) {
> > ++            fclose(fp);
> > ++            return -1;
> > ++    }
> > ++
> > ++    if (!fgets(line, sizeof(line), fp)) {
> > ++            fclose(fp);
> > ++            return -1;
> > ++    }
> > ++    fclose(fp);
> > ++
> > ++    rp = strrchr(line, ')');
> > ++    if (!rp)
> > ++            return -1;
> > ++
> > ++    /*
> > ++     * /proc/<pid>/stat fields after comm are:
> > ++     * state ppid pgrp session tty_nr ...
> > ++     */
> > ++    if (!rp || sscanf(rp + 1, " %*c %*d %*d %*d %ld", &tty_nr) != 1)
> > ++            return -1;
> > ++
> > ++    if (tty_nr <= 0)
> > ++            return -1;
> > ++
> > ++    *uid = st.st_uid;
> > ++    *tty = (dev_t) tty_nr;
> > ++    return 0;
> > ++}
> > ++
> > + /*
> > +  * Support for Spawn_Console: openvt running from init
> > +  * added by Joshua Spoerri, Thu Jul 18 21:13:16 EDT 1996
> > +@@ -88,8 +133,7 @@ authenticate_user(int curvt)
> > +     DIR *dp;
> > +     struct dirent *dentp;
> > +     struct stat buf;
> > +-    dev_t console_dev;
> > +-    ino_t console_ino;
> > ++    dev_t console_rdev;
> > +     uid_t console_uid;
> > +     char filename[NAME_MAX + 12];
> > +     struct passwd *pwnam;
> > +@@ -109,10 +153,12 @@ authenticate_user(int curvt)
> > +                     kbd_error(EXIT_FAILURE, errsv, "%s", filename);
> > +             }
> > +     }
> > +-    console_dev = buf.st_dev;
> > +-    console_ino = buf.st_ino;
> > ++    console_rdev = buf.st_rdev;
> > +     console_uid = buf.st_uid;
> > +
> > ++    if (console_uid == 0)
> > ++            kbd_error(EXIT_FAILURE, 0, _("Refusing to pre-authenticate
> root on current tty."));
>
> Hello,
>
> Isn't this a change in befavior that might break some use-case?
> I don't know how legitimate and/or unsafe it is though...
> Do you know?
>
> I'll hold this in the meantime.
>
> Regards,
> --
> Yoann Congal
> Smile ECS
>
>

[-- Attachment #2: Type: text/html, Size: 9681 bytes --]