CVE-2026-50292: CRLF Injection
A local attacker with /dev/uinput access can inject arbitrary udev properties through the libinput-device-group helper. Depending on downstream udev rules, this can result in root code execution (e.g. via injected REMOVECMD properties executed at device removal time). REMOVECMD is in the default udev rules and expected to be present on virtually all machines.
Other sources
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libinputto a version that resolves this vulnerability.Fixed in 1.16.4-3+deb11u1Fixed in 1.22.1-1+deb12u1Fixed in 1.28.1-1+deb13u1Fixed in 1.31.3-1 - Upgrade
Upgrade
libinputto a version that resolves this vulnerability.Fixed in 1.30.4 - Upgrade
Upgrade
libinputto a version that resolves this vulnerability.Fixed in 1.31.3 - Configuration
Review and harden downstream udev rules so that injected REMOVE_CMD properties cannot trigger execution at device removal time (since REMOVE_CMD is present in default udev rules).
udev (default udev rules) REMOVE_CMD presence/availability = expected to be present on virtually all machines - Compensating control
Mitigate the attack path by preventing untrusted local access to /dev/uinput (since an attacker with /dev/uinput access can inject arbitrary udev properties through the libinput-device-group helper).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50292?
CVE-2026-50292 has a severity rating of 7.4, which is classified as high.
How do I fix CVE-2026-50292?
To fix CVE-2026-50292, update libinput to version 1.30.4 or 1.31.3 or later.
What does CVE-2026-50292 affect?
CVE-2026-50292 affects libinput versions prior to 1.30.4 and 1.31.x before 1.31.3.
What kind of vulnerability is CVE-2026-50292?
CVE-2026-50292 is categorized as a CRLF Injection vulnerability that can lead to arbitrary root code execution.
What are the potential risks associated with CVE-2026-50292?
The potential risks of CVE-2026-50292 include the ability for an attacker to inject udev properties and execute arbitrary code with root privileges.