Summary
It was discovered that libinput did not properly escape device
properties. A local attacker could possibly use this issue to inject
arbitrary udev properties and execute arbitrary code as root.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libinput | 1.20.0-1ubuntu0.4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libinput | 1.15.5-1ubuntu0.3+esm1 |
Vulnerabilities 1
-
High 7.4
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev propert…
References
-
report
https://ubuntu.com/security/CVE-2026-50292