CVE-2026-50292: libinput Local Privilege Escalation via Unescaped phys Output

Technical summary

libinput's device-group utility does not adequately escape or validate the phys output from input devices before passing it to udev property configuration. An attacker can supply a crafted phys string containing shell metacharacters or udev directive syntax that, when processed by the udev property injection mechanism, executes attacker-controlled commands. The vulnerability is classified as CWE-93 (Improper Neutralization of Special Elements used in an HTTP Request). The CVSS 3.1 score of 7.4 (HIGH) reflects high impact across confidentiality, integrity, and availability, combined with a high attack complexity that requires local access and specific conditions but no user interaction.

Business impact

Successful exploitation enables complete system compromise on affected Linux machines. An attacker with local access—such as a malicious user account, container, or guest VM—can escalate to root and maintain persistent control. This risk extends across desktop and server deployments, including CI/CD infrastructure, container hosts, and development workstations that rely on libinput for input device management. Organizations managing fleets of Linux systems should treat this as a credible local privilege escalation vector.

Affected systems

The vulnerability affects freedesktop libinput prior to version 1.30.4 and all versions in the 1.31.x series prior to 1.31.3. Any Linux system running a vulnerable version with libinput-device-group enabled is at risk. This includes standard desktop distributions, embedded Linux systems, and container platforms where input device hotplug handling is active. Check your distribution's package version to determine exposure.

Exploitability

Exploitation requires local system access and the ability to trigger device enumeration or hotplug events with a malicious phys property. The attack complexity is high, meaning specific preconditions (controlled device presentation, udev daemon running) must align. No public exploit code is currently known to be in active use, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the severity and local-only requirement mean determined attackers with device-level control or container escape capabilities can likely craft reliable exploits.

Remediation

Apply patches to libinput: upgrade to version 1.30.4 or later in the 1.30.x series, or to version 1.31.3 or later for 1.31.x deployments. Verify the patch version against your vendor's official advisory before deploying. In interim environments where patching is delayed, restrict local user access and monitor udev property injection logs for suspicious patterns. Disable or limit access to libinput-device-group if device hotplug handling is not essential.

Patch guidance

Consult your Linux distribution's package management system for libinput updates. Verify that the installed version meets or exceeds 1.30.4 (for the 1.30 branch) or 1.31.3 (for the 1.31 branch). Test patches in a non-production environment before rollout. Confirm via dpkg, rpm, or your distribution's query tools that the patched version is running after installation; some systems may require a daemon restart or reboot.

Detection guidance

Monitor udev logs for malformed or suspicious phys property entries that contain shell metacharacters, escape sequences, or udev directives. Watch for unexpected root process execution triggered during device enumeration. Check libinput-device-group process execution and its arguments in security logs. In container environments, audit device hotplug events and udev rule application. Host-based intrusion detection can flag anomalous privilege escalation chains stemming from input device processing.

Why prioritize this

Although the vulnerability requires local access and has high attack complexity, its impact is critical: successful exploitation grants root code execution. Organizations should prioritize patching based on system role: internet-facing servers, shared multi-tenant systems, and container hosts should be updated urgently. Desktop and workstation environments should follow within standard change windows, especially if they support untrusted users or run development workloads.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) reflects the combination of remote unobtainability (local access only, AV:L), high attack complexity (AC:H), and no privileges or user interaction required (PR:N/UI:N). Despite these barriers, the impact is severe: confidentiality, integrity, and availability are all rated high due to unrestricted root code execution. The score appropriately captures a serious local privilege escalation that demands prompt patching but is not as critical as network-accessible remote code execution vulnerabilities.

Frequently asked questions