In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libinput-debuginfoUpgrade libinput-develUpgrade libinput | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade libinputUpgrade libinput-debugsourceUpgrade libinput-utils-debuginfoUpgrade libinput-develUpgrade libinput-testUpgrade libinput-utilsUpgrade libinput-test-debuginfoUpgrade libinput-debuginfo | Jun 23, 2026 | Jun 4, 2026 |
| Debian | — | Upgrade libinput | Jun 16, 2026 | Jun 16, 2026 |
| Redhat_linux | — | Upgrade libinput-utilsUpgrade libinput-debugsourceUpgrade libinput-utils-debuginfoUpgrade libinput-test-debuginfoNo solution existsUpgrade libinputUpgrade libinput-develUpgrade libinput-debuginfo | Jul 16, 2026 | Jun 5, 2026 |
| Rocky_linux | — | Upgrade libinput-develUpgrade libinputUpgrade libinput-utilsUpgrade libinput-debuginfoUpgrade libinput-debugsourceUpgrade libinput-utils-debuginfo | Jul 17, 2026 | Jul 15, 2026 |
| Ubuntu | — | Upgrade libinput-dev (Ubuntu Pro)Upgrade libinput-binUpgrade libinput10 (Ubuntu Pro)Upgrade libinput-toolsUpgrade libinput-devUpgrade libinput10Upgrade libinput-bin (Ubuntu Pro) | Jul 26, 2026 | Jul 23, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub