libinput EUVD-2026-34795

The attacker must have a local interactive or code-execution session on the target RHEL 7/8/9/10 host and must already hold write access to /dev/uinput - typically granted via membership in the input group or via a custom udev rule that loosened /dev/uinput permissions for an accessibility, remote-input, or game-streaming tool. The uinput kernel module must be loaded (it is on most desktop and workstation builds but often absent on minimal server installs), and the libinput-device-group helper must be the path used during device enumeration. CVSS AC:H reflects the additional precision required to craft a uinput device whose attributes propagate into a controllable udev property and to time the REMOVE_CMD trigger; no user interaction (UI:N) and no remote network exposure are involved, which sharply limits the threat to systems where untrusted local users coexist with privileged uinput access.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.0 (High) and accurately reflects the threat shape: local attack vector, high attack complexity, low privileges already required, but full CIA impact once exploited. The high attack complexity reflects that the attacker must already have access to /dev/uinput, which is not granted to unprivileged users by default on stock RHEL configurations, and must craft a property injection that survives helper handling. EPSS, KEV, and POC data were not supplied, so probability of exploitation cannot be quantified externally; based on the precision rules, this is treated as no public exploit identified at time of analysis. Realistic priority is moderate-to-high for multi-user systems, kiosks, shared workstations, and any environment where input device groups (e.g., input, plugdev) are broadly granted, but lower for single-user servers where local access already implies near-equivalent trust. The KEV/EPSS signals are absent from the input data and should be checked directly with CISA and FIRST before final prioritization.

A logged-in low-privileged user on a shared RHEL workstation - for example a developer in the input group, or any account on a kiosk where /dev/uinput was loosened for an accessibility tool - opens /dev/uinput and registers a crafted virtual device whose attributes drive libinput-device-group to set an attacker-controlled udev REMOVE_CMD property on the device. The attacker then triggers device removal, and udev executes the injected command as root, granting a root shell or persistence. No public POC is referenced in the supplied intelligence, but the mechanism (REMOVE_CMD injection via uinput) is well understood and reproducible from the Red Hat bug description.