Not yet scoredPublished Aug 22, 2026

CVE-2026-74676vt: add permission check for KDSKBMETA ioctl

Updated under an hour ago (Oct 27, 2026, 4:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process to change meta mode on a non-controlling console without authorization.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 25, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9f8cbaf4b774694dcc292e60509762483ebfd9ae; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ddc4a8303347114e945b9e6e81b81d77855f7358; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 1c5b67a1e2cb7d78dab321280f330b056e3bf437; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d8ead5083b203d12b8319e7cb29cc6b8836e813f; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4671c3b79e337bbae28c2d79023dc642df012bde; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a1c31e026c93e378e297a8df8328983d3013a59f; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7bf32337a7103ccb686cbd240324bf26225ef2d6; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a7ad0034453ba4c353f9b8f810ee2569de33d283	CNA record

References

References

https://git.kernel.org/stable/c/9f8cbaf4b774694dcc292e60509762483ebfd9ae
https://git.kernel.org/stable/c/ddc4a8303347114e945b9e6e81b81d77855f7358
https://git.kernel.org/stable/c/1c5b67a1e2cb7d78dab321280f330b056e3bf437
https://git.kernel.org/stable/c/d8ead5083b203d12b8319e7cb29cc6b8836e813f
https://git.kernel.org/stable/c/4671c3b79e337bbae28c2d79023dc642df012bde
https://git.kernel.org/stable/c/a1c31e026c93e378e297a8df8328983d3013a59f
https://git.kernel.org/stable/c/7bf32337a7103ccb686cbd240324bf26225ef2d6
https://git.kernel.org/stable/c/a7ad0034453ba4c353f9b8f810ee2569de33d283

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.