CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl
A local attacker can bypass authorization checks to modify keyboard meta mode on non-controlling consoles via the KDSKBMETA ioctl.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74676?
CVE-2026-74676 is a missing authorization vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vt: add permission check for KDSKBMETA ioctl
KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process to change meta mode on a non-controlling console without authorization.
Which versions are affected by CVE-2026-74676?
How do I fix CVE-2026-74676?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-74676 being exploited?
There is no known exploitation of CVE-2026-74676 in the wild and no public exploit code.
Sources
Also known as AZL-97221, BELL-CVE-2026-74676, DEBIAN-CVE-2026-74676, GHSA-r6h8-mfh3-gh59, UBUNTU-CVE-2026-74676.