Summary
It was discovered that libinput did not properly escape device
properties. A local attacker could possibly use this issue to inject
arbitrary udev properties and execute arbitrary code as root.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | libinput | 1.25.0-1ubuntu3.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | libinput | 1.31.1-1ubuntu1.2 |
Vulnerabilities 1
-
High 7.4
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev propert…
References
-
report
https://ubuntu.com/security/CVE-2026-50292