CVE-2026-74676: vt: add permission check for KDSKBMETA ioctl
In the Linux kernel, the following vulnerability has been resolved:
vt: add permission check for KDSKBMETA ioctl
KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl() enforce, allowing a process to change meta mode on a non-controlling console without authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
A process must be able to invoke the KDSKBMETA ioctl on a console that it does not control. The missing permission check allows that process to change the console's keyboard meta mode without authorization.
Is this permission check missing from all keyboard-setting ioctls?
No. The supplied information states that other keyboard setter ioctls in vt_k_ioctl() enforce the !perm check; KDSKBMETA was the exception.
Can I determine affected or fixed kernel versions from the available information?
No specific affected or fixed Linux kernel versions are provided. The listed stable kernel commit references can be used to check whether the resolving change is present in a kernel source tree.