libinput EUVD-2026-34795

Patch available per vendor advisory - apply the libinput updates published by Red Hat for the affected RHEL stream as referenced in https://access.redhat.com/security/cve/CVE-2026-50265 and https://bugzilla.redhat.com/show_bug.cgi?id=2485390, and track upstream resolution at https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296; exact fix versions are not in the provided data and must be taken from the live errata. As compensating controls until the package is updated, restrict /dev/uinput so only trusted services can open it by tightening the udev rule that sets its mode (commonly 0660 root:input) to root-only access or to a narrowly scoped service group, with the trade-off that user-space tools needing virtual input (Steam Input, Barrier, accessibility utilities, certain RDP/remote-control agents) will stop working. Audit membership of the input and any custom uinput groups and remove non-essential users, and consider an SELinux or AppArmor policy that confines the libinput-device-group helper and denies it from writing arbitrary udev properties; SELinux already runs in enforcing mode on default RHEL, so confirm libinput-device-group is in a confined domain. Avoid loading the uinput kernel module (modprobe -r uinput, blacklist in /etc/modprobe.d/) on systems that do not require virtual input devices, accepting that this also breaks any legitimate uinput consumer.