CVE-2026-50265: Libinput: local privilege escalation via crafted uinput devices
A local attacker with /dev/uinput access can inject arbitrary udev properties through the libinput-device-group helper. Depending on downstream udev rules, this can result in root code execution (e.g. via injected REMOVECMD properties executed at device removal time). REMOVECMD is in the default udev rules and expected to be present on virtually all machines.
Other sources
Rejected reason: This CVE ID was assigned as a duplicate of CVE-2026-50292
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50265?
CVE-2026-50265 has a severity rating of high, with a score of 7.
How can I exploit CVE-2026-50265?
CVE-2026-50265 can be exploited by a local attacker with access to /dev/uinput to inject arbitrary udev properties.
What are the potential impacts of CVE-2026-50265?
The potential impacts of CVE-2026-50265 include local privilege escalation and the ability to execute root code.
How do I fix CVE-2026-50265?
To fix CVE-2026-50265, update your freedesktop.org libinput to the latest version where the vulnerability is patched.
What systems are affected by CVE-2026-50265?
CVE-2026-50265 affects systems running freedesktop.org libinput that allow access to /dev/uinput.