Executive brief
A security vulnerability has been identified in libinput, a library used by Linux operating systems to handle input devices like keyboards and mice. A local attacker could place a malicious file on the system to execute unauthorized code with high privileges, typically those of the graphical interface manager. This could allow an attacker to secretly monitor all keyboard activity, including passwords and sensitive data, and send it to an external location.
Technical details
A code injection vulnerability exists in libinput due to the improper loading of Lua plugins. The library uses the 'luaL_loadfile' function, which defaults to 'bt' (binary and text) mode, allowing the execution of unverified Lua bytecode. A local attacker with the ability to write to system or user configuration directories (e.g., /etc/libinput/plugins or XDG_CONFIG_HOME/libinput/plugins) can deploy a crafted bytecode file to bypass sandboxing and execute code with the privileges of the calling process, such as a Wayland compositor. This is particularly impactful on systems where libinput is compiled with '-Dautoload-plugins'. The issue is addressed in libinput versions 1.30.3 and 1.31.1 by switching to 'luaL_loadfilex' with text-only ('t') mode.
Affected products
- freedesktop libinput up to (excluding) 1.30.3, and 1.30.4 up to (excluding) 1.31.1
- fedoraproject Fedora 43, 44
- Red Hat Red Hat Enterprise Linux 7 affected
Timeline
- 2026-04-01: disclosed: Initial report and Bugzilla entry created
- 2026-04-01: advisory: NVD and Red Hat advisories published
- 2026-04-03: patched: Fix identified in libinput 1.30.3 and 1.31.1
References
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2026-35093
- https://bugzilla.redhat.com/show_bug.cgi?id=2453839
- https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1271
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35093.json