CVE-2026-50292 is a high severity (CVSS 7.4) flaw in libinput before 1.30.4 and 1.31.x before 1.31.3. The libinput-device-group helper writes an unescaped physical path value, which can inject udev properties and lead to code execution as root. Update libinput from your distribution.
What's affected
- Product: libinput, the Linux input device library (freedesktop.org).
- Affected: before 1.30.4, and 1.31.x before 1.31.3.
- Fixed: 1.30.4 and 1.31.3, per the CVE record.
- Weakness: CWE-93, improper neutralization of CRLF sequences.
- CVSS 7.4 (high), vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack vector is local and complexity is high. - Published 4 June 2026. Not marked as exploited in CISA KEV.
The record points to an upstream commit, an issue in the libinput tracker and a post on oss-security. The upstream tracker was behind a bot check when I tried to read it, so I rely on the record for the details.
How to check if you're exposed
Check the installed version through your package manager.
libinput --version
# Debian and Ubuntu
dpkg -l | grep -i libinput
# Fedora, RHEL and derivatives
rpm -q libinput
Distributions often backport fixes without changing the upstream version number. If your version is lower than the fixed releases, read your distribution's security tracker for this CVE before assuming you are exposed.
Because the attack vector is local, exposure is greatest on shared systems, kiosks and machines where untrusted devices can be plugged in.
What to do now
- Install the libinput update from your distribution as soon as it ships, and reboot or restart services as the package advises.
- On systems you build yourself, move to 1.30.4 or 1.31.3 or later.
- Restrict physical and local access on shared machines, and consider USB device control where untrusted devices could be attached.
- Check your distribution advisory for guidance specific to your release.
- Record the version of libinput in your system inventory so you can find out quickly next time.
Why it matters
udev rules read properties from helper programs and use them to configure devices, and those rules run with high privilege. The record says a helper wrote a value without escaping it, so a crafted value could add extra properties. That is a line-injection issue, CWE-93, with a high privilege outcome because of where the output goes.
The score is moderated by the need for local access and a hard to meet condition. It still deserves a routine update, since the fix is small and the outcome is root.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Quick check
Can this be exploited over the network?
The vector is local with high complexity, so it is not a remote bug by itself. It matters most where untrusted users or devices can reach the machine.
Sources
- Upstream fix commit (named in the record; not fetched)
- oss-security post (named in the record)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
