CVE-2026-50292

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50292.json",
    "cwe_ids": [
        "CWE-93"
    ],
    "cna_assigner": "mitre"
}

References

Affected packages

Git / gitlab.freedesktop.org/libinput/libinput

Affected ranges

Type

GIT

Repo

https://gitlab.freedesktop.org/libinput/libinput

Events

Introduced

Fixed

7ad8b37ffcc71aceb8eb4d079d22490e87168f49

Introduced

659967488e1e66d7fb7210c6b86860c8e1e5bed4

Fixed

26191d396d74d505541d6311f0b4ae68d791b890

Fixed

76f0d8a7f57e2868882864b4611281f12f704b55

Database specific

{
    "cpe": "cpe:2.3:a:freedesktop:libinput:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.30.4"
        },
        {
            "introduced": "1.31.0"
        },
        {
            "fixed": "1.31.3"
        }
    ]
}

Affected versions

0.*

0.1.0

0.10.0

0.11.0

0.12.0

0.13.0

0.14.0

0.14.1

0.15.0

0.16.0

0.17.0

0.18.0

0.19.0

0.2.0

0.20.0

0.21.0

0.3.0

0.4.0

0.5.0

0.6.0

0.7.0

0.8.0

0.9.0

0.99.1

1.*

1.0.0

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.901

1.1.902

1.10.0

1.10.901

1.10.902

1.11.0

1.11.901

1.11.902

1.11.903

1.12.0

1.12.1

1.12.2

1.12.3

1.12.901

1.12.902

1.13.0

1.13.901

1.13.902

1.14.0

1.14.1

1.14.901

1.15.0

1.15.1

1.15.2

1.15.3

1.15.901

1.15.902

1.16.0

1.16.1

1.16.901

1.16.902

1.17.0

1.17.901

1.18.0

1.18.901

1.19.0

1.19.1

1.19.2

1.19.901

1.2.0

1.2.1

1.2.2

1.2.901

1.2.902

1.2.903

1.20.0

1.21.0

1.22.0

1.23.0

1.24.0

1.25.0

1.26.0

1.26.1

1.26.2

1.27.0

1.27.1

1.28.0

1.28.1

1.28.901

1.28.902

1.28.903

1.29.0

1.29.901

1.29.902

1.3.0

1.3.901

1.30.0

1.30.1

1.30.2

1.30.3

1.31.0

1.31.1

1.31.2

1.4.0

1.4.901

1.5.0

1.5.1

1.5.2

1.5.901

1.5.902

1.6.0

1.6.901

1.6.902

1.7.0

1.7.901

1.7.902

1.8.0

1.8.901

1.8.902

1.9.0

1.9.1

1.9.901

1.9.902

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-50292.json"

vanir_signatures

[
    {
        "target": {
            "file": "udev/libinput-device-group.c"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "185832028376259095753200489930600847899",
                "137638509281561031890796336740529332579",
                "210161599853706076363691495748351230323",
                "146727860333763597701409887157955695727",
                "155115545748819857122308218618577821140",
                "921592902910141038400591007865210960",
                "6294983304254387610488518624627556831",
                "337281478727000962702624878246352080629",
                "38333764473035553740373119183260094022",
                "81918967616046344627468677193119449594",
                "89731050613673694046030041095248986592",
                "121424684239473702160367955492299783347",
                "256419440306143043217885801905236567241",
                "94040713815002756880950301701223006666",
                "77711844217298003166443668859340675226",
                "50328397047322554437217387055503853981",
                "302951578204796163998669248974798065890",
                "200632836181269969083881567281651416857",
                "159179003115257845151767869110238342217",
                "39536797932673218793060690443729464134"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-50292-7b3277fe",
        "signature_version": "v1",
        "source": "https://gitlab.freedesktop.org/libinput/libinput@76f0d8a7f57e2868882864b4611281f12f704b55",
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "udev/libinput-device-group.c",
            "function": "wacom_handle_ekr"
        },
        "source": "https://gitlab.freedesktop.org/libinput/libinput@76f0d8a7f57e2868882864b4611281f12f704b55",
        "digest": {
            "function_hash": "215134354879566460418284008265110796001",
            "length": 1023.0
        },
        "id": "CVE-2026-50292-82ff8a49",
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "udev/libinput-device-group.c",
            "function": "main"
        },
        "source": "https://gitlab.freedesktop.org/libinput/libinput@76f0d8a7f57e2868882864b4611281f12f704b55",
        "digest": {
            "function_hash": "229261457179035828267676353508436572296",
            "length": 1386.0
        },
        "id": "CVE-2026-50292-f0b373a4",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1"
    }
]

vanir_signatures_modified

"2026-06-18T18:58:24Z"