CVE-2026-50265

Summary

A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVE_CMD properties that are executed when a device is removed. This vulnerability allows an attacker to gain elevated privileges on the system.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Workarounds

Restrict access to /dev/uinput to trusted users only. This is the default on virtually all distributions but some packages install udev rules that allow a logged-in user to create uinput devices. Examples for this on Fedora are steam-device, antimicrox, kdeconnectd.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

CVE Program Container

Additional References

References