CVE-2026-50292 Code injection in libinput
Attackers can inject udev properties via unescaped phys output in libinput, leading to arbitrary root code execution on Linux systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50292?
CVE-2026-50292 is a high-severity code injection vulnerability in freedesktop libinput, published on 4 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
Weakness: CWE-93
Which versions are affected by CVE-2026-50292?
It affects 1 product.
Linux distribution packages (18)
libinput AlmaLinux:10 | All versions | 1.30.1-2.el10_2 |
libinput-devel AlmaLinux:10 | All versions | 1.30.1-2.el10_2 |
libinput-utils AlmaLinux:10 | All versions | 1.30.1-2.el10_2 |
libinput Red Hat:enterprise_linux:10.2 | All versions | 0:1.30.1-2.el10_2 |
libinput-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.30.1-2.el10_2 |
libinput-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.30.1-2.el10_2 |
libinput-devel Red Hat:enterprise_linux:10.2 | All versions | 0:1.30.1-2.el10_2 |
libinput-test-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.30.1-2.el10_2 |
libinput-utils Red Hat:enterprise_linux:10.2 | All versions | 0:1.30.1-2.el10_2 |
libinput-utils-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.30.1-2.el10_2 |
libinput Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.26.1-5.el10_0.1 |
libinput-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.26.1-5.el10_0.1 |
libinput-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.26.1-5.el10_0.1 |
libinput-devel Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.26.1-5.el10_0.1 |
libinput-test-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.26.1-5.el10_0.1 |
libinput-utils Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.26.1-5.el10_0.1 |
libinput-utils-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:1.26.1-5.el10_0.1 |
libinput Rocky Linux:10 | All versions | 0:1.30.1-2.el10_2 |
Products include Freedesktop Libinput.
How do I fix CVE-2026-50292?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-50292 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50292 exists.
Other vulnerabilities in freedesktop libinput
Sources
Also known as ALSA-2026:39296, AZL-89378, CLSA-2026-1783709526, CLSA-2026-1784017931, CLSA-2026-1784020479, CLSA-2026-1792170117 and 12 more.