Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-35094 EUVD-2026-17909

Libinput: libinput: information disclosure via dangling pointer in lua plugin handling

Published Apr 1, 2026 · Updated Apr 1, 2026 · Assigned by redhat

Description

A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libinput 1.31.1-1 —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libinput 1.31.1-1.1 openSUSE-SU-2026:10489-1
ReleasePackageFixed inAdvisory
Alpine v3.24 libinput 1.31.1-r0 —

Advisories 1

References