CVE-2026-50292

7.4 HIGH

Published: June 04, 2026 Modified: June 05, 2026

Description

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://gitlab.freedesktop.org/libinput/libinput/-/commit/76f0d8a7f57e2868882864b4611281f12f704b55

Source: cve@mitre.org

Patch

https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296

Source: cve@mitre.org

Vendor Advisory

https://www.openwall.com/lists/oss-security/2026/06/04/5

Source: cve@mitre.org

Mailing List Patch Third Party Advisory

https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Vendor Advisory

4 reference(s) from NVD

Quick Stats

CVSS v3 Score

7.4 / 10.0

EPSS (Exploit Probability)

0.1%

22th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-93

Affected Vendors

freedesktop

Related CVEs