CVE-2026-50292Patch(freedesktop / libinput)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch freedesktop libinput systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution

freedesktop CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

Weakness type (CWE)

CWE-93

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

libinput

Threat summary

Patch or workaround signal is available
6 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 5d ago at 1 mentions (2026-06-05); latest day: 1
6 total mentions across 6 days

Affected systems

Vendors

freedesktop

Products

libinput

Deep dive

Activity timeline6 mentions / 6d

Signal classification3 categories

Patch

350.0%

General

233.3%

Disclosure

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-05	1	General1
2026-06-06	1	Patch1
2026-06-11	1	Disclosure1
2026-06-12	1	General1
2026-06-24	1	Patch1
2026-09-02	1	Patch1

Full discourse6 posts

pinfort@pinfort48d
Patch
https://ubuntu.com/security/CVE-2026-50292 え、修正更新がまだリリースされてないってこと https://t.co/0hf0LQRbWA
Post summary
The tweet informs that a patch for CVE‑2026‑50292 has not yet been released, linking to the Ubuntu security advisory for further details.
01021419
1.6K followersView on X
Ferramentas Linux@Cezar_H_Linux130d
General
Duas vulnerabilidades críticas no libinput (CVE-2022-1215 e CVE-2026-50292) podem comprometer seu Debian. Saiba mais: -> http://tinyurl.com/4m9xrz5w #Debian https://t.co/ZUUaUGByce
Post summary
The tweet flags two critical libinput CVEs that could affect Debian systems and directs readers to a link for more details, but provides no additional technical information, PoC, exploit, or patch guidance.
1002097
1.5K followersView on X
Ferramentas Linux@Cezar_H_Linux117d
Patch
SUSE-SU-2026:2523-1: atualização do libinput corrige CVE-2026-50265 e CVE-2026-50292 — dispositivos uinput manipulados → escalonamento de privilégios local via injeção de propriedade udev. Saiba mais: -> http://tinyurl.com/mrj42987 #SUSE https://t.co/bNhKCcbPrs
Post summary
Notice announces a libinput update that patches two local privilege escalation CVEs related to manipulated uinput devices.
1000039
1.5K followersView on X
Ferramentas Linux@Cezar_H_Linux131d
Disclosure
🐧 CVE-2026-50292: uma falha crítica no libinput (pacote comum em todos os Linux) pode dar root a qualquer usuário local no Debian. Saiba mais: -> http://tinyurl.com/5b9bzwep #Debian https://t.co/vVpX5f8xmZ
Post summary
An announcement of CVE-2026-50292, a critical libinput flaw on Debian that can grant any local user root privileges.
1000060
1.5K followersView on X
SecAlerts@SecAlertsCo136d
Patch
CVE-2026-50292: Critical 9.8 CRLF injection in libinput before 1.30.4/1.31.3. Unescaped phys output injects udev properties, enabling arbitrary root code execution. Patch now. #linux #infosec https://secalerts.co/vulnerability/CVE-2026-50292 https://t.co/Dv5xgQwjLH
Post summary
The post announces CVE-2026-50292, a critical CRLF injection in libinput that allows arbitrary root execution, and notes that a patch is now available.
0000078
831 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
General
CVE-2026-50292 Arbitrary Root Code Execution via Udev Property Injection in libinput Before 1.30.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50292
Post summary
CVE-2026-50292 is a root code execution vulnerability in libinput (pre‑1.30.4). No proof of concept, exploit code, patch, or active exploitation details are included.
0000056
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	freedesktop	libinput	-	-	-

Explore more

Back to dashboard freedesktop CVEs libinput vulnerabilities

What researchers are saying

CVE-2026-50292

pinfort@pinfortPatch

The tweet informs that a patch for CVE‑2026‑50292 has not yet been released, linking to the Ubuntu security advisory for further details.

Ferramentas Linux@Cezar_H_LinuxGeneral

The tweet flags two critical libinput CVEs that could affect Debian systems and directs readers to a link for more details, but provides no additional technical information, PoC, exploit, or patch guidance.

Ferramentas Linux@Cezar_H_LinuxPatch

Notice announces a libinput update that patches two local privilege escalation CVEs related to manipulated uinput devices.

Ferramentas Linux@Cezar_H_LinuxDisclosure

An announcement of CVE-2026-50292, a critical libinput flaw on Debian that can grant any local user root privileges.

SecAlerts@SecAlertsCoPatch

The post announces CVE-2026-50292, a critical CRLF injection in libinput that allows arbitrary root execution, and notes that a patch is now available.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

CVE-2026-50292 is a root code execution vulnerability in libinput (pre‑1.30.4). No proof of concept, exploit code, patch, or active exploitation details are included.