CVE Intelligence
Analysis AI-assisted

CVE-2026-50292: Freedesktop libinput: udev property injection via unescaped phys output

CVE-2026-50292 affects Freedesktop libinput before 1.30.4 and from 1.31.0 up to before 1.31.3, where the phys value used by libinput-device-group is not escaped, allowing udev properties to be injected. The record describes this as leading to arbitrary code execution as root. NVD scores it 9.8 (critical), and the CVE is not listed in CISA KEV; no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-50292 concerns the device group handling in libinput. The phys value associated with devices is written into udev properties without escaping, which the record says allows property injection and arbitrary code execution as root. The CVE was published on 2026-06-04.

Impact

  • The record states the impact as arbitrary code execution as root.
  • NVD rates the vulnerability 9.8 (critical) with high confidentiality, integrity and availability impact.
  • The MITRE CNA record lists a score of 7.4 for the same CVSS 3.1 base vector family.

Affected products and versions

  • Freedesktop libinput before 1.30.4.
  • Freedesktop libinput from 1.31.0 up to before 1.31.3.
  • Versions outside these ranges are not stated as affected in the record.

Exploitation status

CISA KEV does not list this CVE, so no active exploitation is confirmed by that catalog. The sources consulted do not confirm exploitation in the wild. The SSVC data in the record carries an exploitation value of poc, which indicates that proof-of-concept material is recorded as existing; this is a recorded assessment, not confirmation of attacks. EPSS reports a probability of 0.00532 and a percentile of 0.44142 with a date of 2026-10-23.

Remediation and mitigation

  • Upgrade libinput to 1.30.4 or later, or to 1.31.3 or later for installations in the series starting at 1.31.0.
  • Check whether your Linux distribution has backported the fix, since the record does not say.
  • Review the upstream commit and the oss-security announcement for the fix details.

Detection guidance

  • Inventory hosts that ship libinput and compare installed versions with the fixed versions above.
  • Review udev-related device properties on systems with input devices for values that look unexpected or malformed.
  • Keep logs of udev and device management activity for later review.

Limitations of the available information

  • The record does not name the CWE it is linked to, so the classification is limited to the identifier CWE-93.
  • The record does not confirm public exploit availability beyond the SSVC value, and does not describe distribution backport status.
  • Technical details beyond the description and the linked patch are not provided in the record.

Frequently asked questions

Which libinput versions are affected by CVE-2026-50292?

The record lists libinput before 1.30.4 and versions from 1.31.0 up to before 1.31.3 as affected.

Is this vulnerability being actively exploited?

CISA KEV does not list this CVE, and the sources consulted do not confirm exploitation in the wild. The SSVC data records an exploitation value of poc.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.