CVE-2026-74676 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
vt: add permission check for KDSKBMETA ioctl
KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process to change meta mode on a non-controlling console without authorization.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel's virtual terminal subsystem contains an access control flaw within the implementation of the KDSKBMETA ioctl command. This specific interface is designed to modify keyboard meta modes, which dictate how certain key combinations are interpreted by the system for text processing and input handling. While other setter ioctls in the vt_k_ioctl function correctly enforce permission checks to ensure that only processes with appropriate privileges can alter terminal settings, KDSKBMETA was missing this critical validation step. This oversight creates a gap in the security model of the virtual console subsystem, allowing unprivileged or unauthorized users to manipulate keyboard behavior on consoles they do not control.
The technical root cause lies in the absence of a permission check within the code path handling the KDSKBMETA ioctl call. In Linux terminal management, operations that change global state for a specific console typically require ownership of that console's controlling process group or sufficient privileges such as CAP_SYS_ADMIN. By omitting this verification, the kernel fails to distinguish between authorized administrators and regular users attempting to alter system-wide input parameters. This deviation from established patterns in vt_k_ioctl exposes the underlying terminal driver to unauthorized modification requests, effectively bypassing standard access control mechanisms intended to isolate user sessions and maintain system integrity.
The operational impact of this vulnerability allows an attacker with local shell access on a multi-user Linux system to interfere with keyboard processing for other users or services running on non-controlling consoles. An adversary could potentially alter meta modes to disrupt normal input interpretation, causing denial-of-service conditions where legitimate keystrokes are misinterpreted or ignored. Furthermore, depending on the specific configuration and subsequent use of these altered settings, there may be implications for data integrity if sensitive inputs are processed incorrectly due to changed key mapping behaviors. This represents a localized privilege escalation vector in terms of system control, enabling unauthorized modification of core input subsystem parameters without proper authentication.
To mitigate this risk, it is essential that the kernel source code be updated to include the missing permission check within the KDSKBMETA handler, aligning its security model with other keyboard setter ioctls. System administrators should ensure their Linux distributions are patched with the latest kernel updates provided by vendors who have addressed this specific flaw in vt_k_ioctl. Until patches are applied, limiting physical access and restricting shell access to trusted users remains the primary defense against exploitation of this local vulnerability. The fix ensures that only processes owning the controlling terminal or possessing elevated privileges can modify keyboard meta modes, thereby restoring proper isolation between user sessions and preventing unauthorized state changes.
This issue is categorized under CWE-269 Improper Privilege Management as it involves a failure to enforce required permissions for a system operation. It also aligns with ATT&CK technique T1053 Scheduled Task/Job related to local persistence or execution contexts, although more directly it reflects weaknesses in access control logic that could facilitate lateral movement or disruption within a compromised host environment by altering fundamental input handling mechanisms without authorization.