libinput CVE-2026-50292

Exploitation requires the attacker to present an input device whose 'phys' (physical path) property contains udev property-injection characters, and requires udev to invoke the libinput-device-group helper (its default integration on systemd/udev-based Linux) so the unescaped output is parsed as udev properties. Concrete delivery paths: physically attaching a crafted USB/HID device, or local creation of a virtual device via /dev/uinput with an attacker-controlled phys value. Limiting factors that reduce realistic risk: it is not remotely reachable over the network despite the NVD AV:N rating, no existing user session or interaction is strictly needed but device-presentation access is, and systems that do not run the libinput-device-group udev rule (e.g. many headless servers without libinput) are not exposed.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) overstates real-world reach: this is not a network-facing service. Exploitation requires controlling an input device's phys attribute, which in practice means physically attaching a crafted device or locally registering a virtual/uinput device - the network attack vector is not credible for this defect, so the true vector is physical or local. That assessment is corroborated by the low signals from other sources: EPSS is 0.02% (6th percentile) and the SSVC decision is Exploitation=PoC, Automatable=No, Technical Impact=Total. So while the technical impact is genuinely total (root code execution), the automatability is low and the delivery path is constrained. This is a serious local/physical privilege-escalation issue on Linux graphical systems rather than a mass-exploitable remote RCE; prioritize patching on multi-user, kiosk, and shared-hardware systems, but the AV:N-implied urgency should be tempered. Discrepancy to verify with vendor: NVD marks AV:N while the described mechanism (device phys injection via udev) implies AV:P/AV:L.

An attacker with brief physical access to a shared workstation plugs in a USB device whose kernel phys path has been crafted to contain udev property-injection sequences; when udev enumerates the device and runs libinput-device-group, the unescaped phys value injects a RUN directive that udevd executes as root, giving the attacker a root shell. A local user could achieve the same by creating a uinput virtual device with a malicious phys string. Public proof-of-concept exploit code exists (SSVC: PoC), lowering the bar for weaponization.