In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libinputUpgrade libinput-develUpgrade libinput-debuginfo | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade libinput-test-debuginfoUpgrade libinput-utilsUpgrade libinput-debuginfoUpgrade libinput-testUpgrade libinput-utils-debuginfoUpgrade libinput-develUpgrade libinputUpgrade libinput-debugsource | Jun 23, 2026 | Jun 4, 2026 |
| Debian | — | Upgrade libinput | Jun 16, 2026 | Jun 16, 2026 |
| Redhat_linux | — | Upgrade libinput-utils-debuginfoUpgrade libinput-test-debuginfoUpgrade libinput-debugsourceUpgrade libinput-utilsUpgrade libinput-debuginfoUpgrade libinput-develNo solution existsUpgrade libinput | Jul 16, 2026 | Jun 5, 2026 |
| Rocky_linux | — | Upgrade libinputUpgrade libinput-develUpgrade libinput-utilsUpgrade libinput-debuginfoUpgrade libinput-utils-debuginfoUpgrade libinput-debugsource | Jul 17, 2026 | Jul 15, 2026 |
| Ubuntu | — | Upgrade libinput-devUpgrade libinput-dev (Ubuntu Pro)Upgrade libinput-binUpgrade libinput10 (Ubuntu Pro)Upgrade libinput-toolsUpgrade libinput-bin (Ubuntu Pro)Upgrade libinput10 | Jul 26, 2026 | Jul 23, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub