openvt -u is supposed to identify the console owner and then start a login session as that user from a privileged context. The underlying check incorrectly uses stat on /proc/<pid>/fd/0, which resolves to the TTY device node and reports its owner instead of the process owner. This flaw allows an attacker who can keep an unprivileged process attached to a root-owned TTY after logout to fool the check into thinking the process is privileged, permitting a passwordless login as root. The vulnerability results in local privilege escalation and fulfills CWE-284: Improper Access Control.

Affected products include Red Hat Enterprise Linux 10, 6, 7, 8, and 9, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. All versions of these listings are impacted because the issue resides in the openvt utility shipped with these distributions; no version pinning was provided in the advisory.

The CVSS score of 7.8 indicates a high severity for local privilege escalation, but the EPSS score is not available, and the flaw is not currently listed in CISA KEV. The attack path requires privileged kbrequest/init deployments that invoke openvt -u; an attacker would need to execute or influence an unprivileged process holding the root TTY, then trigger the faulty ownership test. Once the test succeeds, a passwordless login -f root is started, giving full system control. Because the flaw is limited to the specific kbrequest/init scenario, the risk to systems that do not use this deployment path is lower.