CVE-2026-72693: Fedora 43 kbd openvt -u Local Privilege Escalation — Detection and Remediation

---
title: Fedora kbd openvt -u Invocation With Suspicious Command
id: 9c4a7f21-6bd3-4c35-a6d8-cve202672693a
status: experimental
description: Detects invocation of openvt with the -u option together with commands commonly used for interactive shells, script execution, or post-compromise activity. Relevant to CVE-2026-72693 hunting on Fedora 43 kbd.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-kbd-2026-3a1183df4c
  - https://attack.mitre.org/techniques/T1548/
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.privilege_escalation
  - attack.t1548
logsource:
  category: process_creation
  product: linux
detection:
  selection_image:
    Image|endswith: '/openvt'
  selection_u:
    CommandLine|contains:
      - ' -u '
      - ' -u'
      - '--user'
  selection_suspicious:
    CommandLine|contains:
      - 'bash'
      - ' sh'
      - 'zsh'
      - 'fish'
      - 'python'
      - 'perl'
      - 'ruby'
      - 'nc '
      - 'ncat'
      - 'socat'
      - 'curl'
      - 'wget'
      - 'base64'
  condition: selection_image and selection_u and selection_suspicious
falsepositives:
  - Legitimate console launchers and kiosk/session scripts that use openvt to start shells
  - Administrative automation on terminal servers
level: medium
---
title: Privileged Shell Or Elevation Tool Spawned By openvt
id: 3e8d1b54-aa61-4a19-9a31-cve202672693b
status: experimental
description: Detects shells or privilege-elevation tools spawned as children of openvt. Useful as a high-signal hunt after patching CVE-2026-72693 and when investigating local privilege-boundary abuse.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-kbd-2026-3a1183df4c
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1548/
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1059
  - attack.t1548
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/openvt'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/fish'
      - '/su'
      - '/sudo'
      - '/doas'
  condition: selection_parent and selection_child
falsepositives:
  - Normal use of openvt to launch a shell on a virtual terminal by administrators or session software
level: medium

let lookback = 14d;
union isfuzzy=true
(
  Syslog
  | where TimeGenerated > ago(lookback)
  | where SyslogMessage has "openvt" and SyslogMessage has "-u"
  | project TimeGenerated, Computer, HostName, ProcessName, SyslogMessage, SeverityLevel, Facility
  | extend Source = "Syslog"
),
(
  DeviceProcessEvents
  | where TimeGenerated > ago(lookback)
  | where FileName =~ "openvt" or ProcessCommandLine has "openvt"
  | where ProcessCommandLine has "-u" or ProcessCommandLine has "--user"
  | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, SHA256
  | extend Source = "MDE"
)
| extend SuspiciousCommand = tostring(extract(@"(?i)(openvt.*-u.*(bash| sh|zsh|fish|python|perl|ruby|nc |ncat|socat|curl|wget|base64))", 1, coalesce(ProcessCommandLine, SyslogMessage)))
| where isnotempty(SuspiciousCommand) or Source == "MDE"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Sources=make_set(Source), Commands=make_set(coalesce(ProcessCommandLine, SyslogMessage), 20) by Computer=coalesce(Computer, DeviceName), Account=coalesce(AccountName, InitiatingProcessAccountName)
| order by LastSeen desc;

-- Hunt endpoints for openvt -u execution and potentially suspicious child commands.
-- Scope to Linux clients that may run Fedora 43 kbd before FEDORA-2026-3a1183df4c.
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '/openvt$'
  AND CommandLine =~ '(^|\\s)-u(\\s|$)|--user'
  AND CommandLine =~ '(?i)(bash| sh|zsh|fish|python|perl|ruby|nc |ncat|socat|curl|wget|base64)'
ORDER BY CreateTime DESC

#!/usr/bin/env bash
# Fedora 43 kbd / CVE-2026-72693 verify-and-remediate helper.
# Run as root or via sudo. It reports state, refreshes metadata, upgrades kbd, and re-checks.
set -euo pipefail

CVE='CVE-2026-72693'
UPDATE='FEDORA-2026-3a1183df4c'

need_root() {
  if [ "${EUID:-$(id -u)}" -ne 0 ]; then
    echo "[-] Run as root or with sudo." >&2
    exit 1
  fi
}

need_root

echo "[*] OS release"
cat /etc/os-release | egrep '^(NAME|VERSION|VERSION_ID)=' || true
if ! grep -qi 'Fedora' /etc/os-release; then
  echo "[-] This script is intended for Fedora; validate manually on derived distributions." >&2
fi

echo "[*] Current kbd package"
rpm -q kbd || true

echo "[*] openvt binary attributes"
OPENVT="$(command -v openvt || true)"
if [ -n "$OPENVT" ]; then
  stat -c '%A %U:%G %n' "$OPENVT"
  getcap "$OPENVT" 2>/dev/null || true
  if find "$(dirname "$OPENVT")" -maxdepth 1 -name openvt -perm /6000 -print -quit | grep -q .; then
    echo "[!] openvt has setuid/setgid bits. Validate why before changing anything."
  fi
else
  echo "[*] openvt not found in PATH."
fi

echo "[*] Checking update metadata for ${CVE} / ${UPDATE}"
dnf -y updateinfo list --refresh 2>/dev/null | egrep -i "${CVE}|${UPDATE}|kbd" || true

echo "[*] Applying kbd update"
dnf -y upgrade --refresh kbd

echo "[*] Post-update package state"
rpm -q kbd
rpm -q --changelog kbd 2>/dev/null | egrep -i -A4 -B4 "${CVE}|${UPDATE}|openvt" || true

echo "[*] Find privileged wrappers referencing openvt -u"
grep -RIl --exclude-dir={proc,sys,dev,run} 'openvt' /etc /usr/local /opt /root 2>/dev/null | while read -r f; do
  if grep -Eq 'openvt([^\n]*)([[:space:]]-u([[:space:]]|$)|--user)' "$f" 2>/dev/null; then
    echo "[review] $f"
  fi
done

echo "[*] Auditd watch suggestion: add execve auditing for openvt if not already covered by process logging."
echo "    Example: auditctl -a always,exit -F arch=b64 -S execve -F exe=/usr/bin/openvt -k priv_esc_openvt"