CVE-2026-50265

CVE-2026-50265 concerns libinput, where a local attacker with access to /dev/uinput can inject arbitrary udev properties via the libinput-device-group helper. This can lead to root code execution, for example by exploiting REMOVE_CMD properties executed when a device is removed, enabling elevated...

CVE-2026-50265 Libinput: local privilege escalation via crafted uinput devices

A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVECMD properties that are executed when a device is removed. This...