CVE-2026-50292: CRLF Injection
A local attacker with /dev/uinput access can inject arbitrary udev properties through the libinput-device-group helper. Depending on downstream udev rules, this can result in root code execution (e.g. via injected REMOVECMD properties executed at device removal time). REMOVECMD is in the default udev rules and expected to be present on virtually all machines.
Other sources
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libinputto a version that resolves this vulnerability.Fixed in 1.22.1-1+deb12u1Fixed in 1.28.1-1+deb13u1Fixed in 1.31.3-1 - Upgrade
Upgrade
libinputto a version that resolves this vulnerability.Fixed in 1.30.4 - Upgrade
Upgrade
libinputto a version that resolves this vulnerability.Fixed in 1.31.3 - Compensating control
Ensure that downstream udev rules do not execute commands based on injected udev properties such as REMOVE_CMD; in particular, prevent any udev rule from honoring REMOVE_CMD from the libinput-device-group unescaped phys output.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50292?
CVE-2026-50292 has a severity rating of 7.4, which is classified as high.
How do I fix CVE-2026-50292?
To fix CVE-2026-50292, update libinput to version 1.30.4 or 1.31.3 or later.
What does CVE-2026-50292 affect?
CVE-2026-50292 affects libinput versions prior to 1.30.4 and 1.31.x before 1.31.3.
What kind of vulnerability is CVE-2026-50292?
CVE-2026-50292 is categorized as a CRLF Injection vulnerability that can lead to arbitrary root code execution.
What are the potential risks associated with CVE-2026-50292?
The potential risks of CVE-2026-50292 include the ability for an attacker to inject udev properties and execute arbitrary code with root privileges.