Skip to main content

libinput CVE-2026-50292

| EUVDEUVD-2026-34302 CRITICAL
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
2026-06-04 mitre GHSA-jcq8-v68h-2c44
RCE Libinput Freedesktop
Critical
Disputed · 9.8 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.6 HIGH

Requires presenting a device with a crafted phys value (physical/local), so AV:P not AV:N; udev runs the helper as root giving scope change and total C/I/A impact.

3.1 AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
HIGH
qualitative
Red Hat
6.7 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 22, 2026 - 20:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 22, 2026 - 20:22 vuln.today
cvss_changed
Severity Changed
Jul 22, 2026 - 20:22 NVD
HIGH CRITICAL
CVSS changed
Jul 22, 2026 - 20:22 NVD
7.4 (HIGH) 9.8 (CRITICAL)
Patch available
Jun 04, 2026 - 19:01 EUVD
Analysis Generated
Jun 04, 2026 - 18:04 vuln.today

DescriptionNVD

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

AnalysisAI

Arbitrary root code execution in libinput before 1.30.4 and 1.31.x before 1.31.3 arises because the libinput-device-group helper emits the device 'phys' (physical path) property without escaping it. Since this output is consumed by udev - which runs as root - an attacker who controls a device's phys string can inject additional udev properties and have commands executed with root privileges. Publicly available exploit code exists (SSVC exploitation: PoC) but EPSS is very low (0.02%, 6th percentile) and it is not on CISA KEV, indicating no confirmed in-the-wild exploitation.

Technical ContextAI

libinput is the freedesktop.org input-handling library that mediates keyboards, mice, touchpads and tablets for virtually every modern Wayland compositor and the X.Org libinput driver. Its device-grouping helper (libinput-device-group) is invoked from udev rules to compute a stable identifier for related input devices, and it prints device attributes including 'phys', the kernel-reported physical connection path. The flaw is a CWE-93-class output-neutralization failure: because the phys value is written into udev's property stream without escaping newline/special sequences, a crafted phys string can terminate the intended property and inject attacker-chosen udev properties (e.g. RUN/IMPORT directives), which udevd then evaluates as root. The affected component is cpe:2.3:a:freedesktop:libinput across all versions below 1.30.4 and the 1.31.x line below 1.31.3.

RemediationAI

Vendor-released patch: upgrade to libinput 1.30.4 or, on the 1.31.x branch, to 1.31.3, which escape the phys output before it reaches udev; the upstream fix is in commit 76f0d8a7f57e2868882864b4611281f12f704b55 (https://gitlab.freedesktop.org/libinput/libinput/-/commit/76f0d8a7f57e2868882864b4611281f12f704b55) and the disclosure is at https://www.openwall.com/lists/oss-security/2026/06/04/5. Apply your distribution's updated libinput package as the primary fix. Where immediate patching is not possible, compensating controls include restricting physical USB/device access on shared, kiosk, and lab machines (BIOS/USBGuard allow-listing of known devices), and tightening access to /dev/uinput so unprivileged users cannot register virtual input devices with attacker-chosen phys strings - note this can break legitimate accessibility tools, remote-input software, and virtualization guest-additions that rely on uinput. Review any custom udev rules that call libinput-device-group and consider disabling non-essential ones until patched, accepting that device-grouping behavior for tablets/touchpads may degrade.

More in Libinput

View all
CVE-2026-35093 HIGH
8.8 Apr 01

Local privilege escalation in libinput allows authenticated users to execute arbitrary code within graphical compositor

CVE-2022-1215 HIGH
7.8 Jun 02

A format string vulnerability was found in libinput. Rated high severity (CVSS 7.8), this vulnerability is low attack co
CVE-2026-35094 LOW
3.3 Apr 01

Libinput versions prior to 1.26.0 contain a dangling pointer vulnerability in Lua plugin garbage collection that allows

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all
CVE-2016-3115 MEDIUM POC
6.4
CVE-2026-84372 CRITICAL POC
9.8
CVE-2021-39172 HIGH POC
8.8
CVE-2026-23953 HIGH POC
8.7
CVE-2026-54511 HIGH POC
8.6
CVE-2026-70615 HIGH POC
8.5
CVE-2024-45302 HIGH POC
7.8
CVE-2017-5868 MEDIUM POC
6.1

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

Share

CVE-2026-50292 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy