CVE-2026-35094: Libinput: libinput: information disclosure via dangling pointer in lua plugin handling
A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.
Other sources
An attacker that can deploy a lua file {/usr/share,/etc}/libinput/plugins and possibly XDGCONFIGHOME/libinput/plugins can call a GC cleanup function and leave a dangling pointer. This pointer can then be printed to the system logs, potentially exposing sensitive data once the memory location is re-used. For the exploit to work, lua plugins must be enabled in libinput and loaded by the compositor. If libinputis compiled with -Dautoload-plugins any plugin is loaded automatically (Fedora 43 and 44). The XDGCONFIGHOME directory is only loaded if enabled by the compositor (e.g. mutter 50 does this). The attacker must be able to deploy a lua plugin in one of the directories loaded by libinput.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35094?
CVE-2026-35094 has been classified as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2026-35094?
To fix CVE-2026-35094, ensure that your libinput is updated to the latest version that addresses this vulnerability.
Who is affected by CVE-2026-35094?
CVE-2026-35094 affects systems using the libinput library where Lua plugins can be deployed in specific directories.
What type of vulnerability is CVE-2026-35094?
CVE-2026-35094 is an information disclosure vulnerability caused by a dangling pointer in the Lua plugin handling of libinput.
Can CVE-2026-35094 be exploited remotely?
CVE-2026-35094 requires an attacker to have local access to deploy the malicious Lua plugin, thus it cannot be exploited remotely.