CVE-2026-50292: Freedesktop Libinput

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

Affected products

• Freedesktop Libinput: before 1.30.4 (fixed in 1.30.4); from 1.31.0, before 1.31.3 (fixed in 1.31.3)

Published 2026-06-04. Last modified 2026-07-22.