In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libinputUpgrade libinput-debuginfoUpgrade libinput-devel | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade libinput-develUpgrade libinput-utils-debuginfoUpgrade libinput-testUpgrade libinput-debugsourceUpgrade libinputUpgrade libinput-test-debuginfoUpgrade libinput-utilsUpgrade libinput-debuginfo | Jun 23, 2026 | Jun 4, 2026 |
| Debian | — | Upgrade libinput | Jun 16, 2026 | Jun 16, 2026 |
| Redhat_linux | — | Upgrade libinput-utils-debuginfoUpgrade libinput-debugsourceUpgrade libinput-test-debuginfoUpgrade libinput-utilsUpgrade libinputUpgrade libinput-debuginfoUpgrade libinput-develNo solution exists | Jul 16, 2026 | Jun 5, 2026 |
| Rocky_linux | — | Upgrade libinput-develUpgrade libinput-utilsUpgrade libinput-debuginfoUpgrade libinputUpgrade libinput-debugsourceUpgrade libinput-utils-debuginfo | Jul 17, 2026 | Jul 15, 2026 |
| Ubuntu | — | Upgrade libinput-devUpgrade libinput-binUpgrade libinput-dev (Ubuntu Pro)Upgrade libinput10 (Ubuntu Pro)Upgrade libinput10Upgrade libinput-bin (Ubuntu Pro) | Jul 26, 2026 | Jul 23, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub