Executive brief
A security vulnerability in libinput, a library used by Linux systems to handle input devices like keyboards and mice, could allow a local user to gain administrative (root) control of the system. By creating a specially crafted virtual input device, an attacker can trick the system's device manager into running unauthorized commands. This could lead to a complete system takeover, data theft, or permanent disruption of the computer's operations.
Technical details
A command injection vulnerability exists in the libinput-device-group helper due to improper neutralization of control characters in the 'phys' string of input devices. When libinput-device-group is executed by udev via IMPORT{program}, it prints the LIBINPUT_DEVICE_GROUP property to stdout. An attacker with access to /dev/uinput can use UI_SET_PHYS to include newline characters followed by malicious udev properties (e.g., REMOVE_CMD). Because libinput fails to escape these newlines, udev interprets the injected lines as separate, valid properties. If an attacker injects a property like REMOVE_CMD, the system will execute the specified arbitrary command with root privileges when the virtual device is removed.
Affected products
- freedesktop.org libinput Up to and including 1.28.1-1
Timeline
- 2026-05-27: other: Vulnerability observed in upstream main snapshot
- 2026-06-05: disclosed: Public disclosure and CVE assignment