`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deploym
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-72693 is a privilege escalation vulnerability in openvt where the authentication mechanism incorrectly validates user ownership by following symlinks in the /proc filesystem. The vulnerability exists in the `authenticate_user()` function which uses `stat()` on `/proc/<pid>/fd/0` to determine process ownership. However, `stat()` follows the symlink to the underlying TTY device node, causing the ownership check to reflect the TTY device owner (often root) rather than the actual process owner. This allows an unprivileged attacker to bypass authentication controls and execute commands with elevated privileges when a TTY is owned by root. Systems using openvt for privileged operations—particularly in containerized or multi-tenant environments—are at risk of unauthorized privilege escalation.
Casky.ai's security skills mapped to MITRE ATT&CK would help practitioners detect the behavioral patterns associated with this vulnerability through detection of Privilege Escalation (T1134) and Abuse of Elevation Control Mechanism (T1548) techniques. While this specific CVE maps to CWE-284 (Improper Access Control) rather than a directly mapped ATT&CK technique, Casky's extended reasoning capabilities would identify suspicious patterns: unexpected `stat()` calls on `/proc/*/fd/0` followed by privilege context switches, authentication bypasses originating from non-privileged processes, or unusual openvt invocations that succeed despite user mismatch. Practitioners would observe findings indicating improper symlink dereferencing in access control logic and could correlate these with process execution anomalies to confirm exploitation attempts before privilege escalation occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-72693. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation