Executive brief
libinput is a library used by Linux operating systems to handle input devices like keyboards and mice. A security flaw in a helper tool called libinput-device-group allows a local attacker to trick the system into running malicious commands with administrative (root) privileges. This occurs when a user creates a specially crafted virtual input device that injects hidden instructions into the system's device management service.
Technical details
A CRLF injection vulnerability (CWE-93) exists in the libinput-device-group udev helper. The utility fails to sanitize the 'phys' sysattr string retrieved from input devices before printing it as part of a KEY=VALUE pair. Because this output is consumed by udev via the IMPORT{program} directive, an attacker can use a malicious uinput or uhid device to set a 'phys' value containing newline characters followed by additional udev properties (e.g., REMOVE_CMD). If the attacker has access to /dev/uinput (often granted via uaccess on certain distributions), they can achieve local privilege escalation to root. The issue is fixed in versions 1.30.4 and 1.31.3 by sanitizing the 'phys' string before output.
Affected products
- freedesktop.org libinput < 1.30.4, 1.31.x < 1.31.3
Timeline
- 2026-06-01: patched: Fix committed to upstream repository
- 2026-06-04: disclosed: Public disclosure on oss-security mailing list
- 2026-06-04: advisory: NVD publication date