Detections
Analytics
CVE-2026-50265
high
Description
A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVE_CMD properties that are executed when a device is removed. This vulnerability allows an attacker to gain elevated privileges on the system.
References
https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296
https://bugzilla.redhat.com/show_bug.cgi?id=2485390