Local Privilege Escalation Vulnerability in libinput: Moderate Security Risk
Summary
RLSA-2026:39296: Moderate: libinput security update. Affects libinput versions < 0:1.30.1-2.el10_2. Fixed in 0:1.30.1-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libinput is a library designed for handling input devices such as keyboards, mice, and touchscreens for display servers and applications that require direct interaction with these devices. It provides a unified interface for various input devices, ensuring consistent behavior across different environments. However, due to its deep integration with system input handling, it is susceptible to security vulnerabilities that can lead to unauthorized access or privilege escalation.
Vulnerability Detail
The vulnerability identified as CVE-2026-50292 allows for local privilege escalation through the use of crafted uinput devices. This means that a malicious user could exploit this flaw to gain elevated privileges on the system, potentially allowing them to execute arbitrary code or access sensitive information. The vulnerability arises from improper handling of input devices, which can be manipulated to bypass security restrictions.
How To Fix
Minimum fixed version
0:1.30.1-2.el10_2
This is the first release that contains the fix.
sudo dnf update libinputTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the uinput devices or restrict the ability to create crafted uinput devices by adjusting user permissions. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The libinput library has a moderate security vulnerability that could allow local privilege escalation through crafted uinput devices. It is crucial for users to update their libinput package to the latest version to protect against potential exploits. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for libinput →
FAQ
CVE-2026-50292 is a security vulnerability in the libinput library that allows local privilege escalation via crafted uinput devices.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow an attacker to gain elevated privileges, execute arbitrary code, or access sensitive data on the affected system.
Yes, a patched version of libinput is available. Users should update to version 0:1.30.1-2.el10_2 or later to mitigate the risk.
The CVSS score for this vulnerability is 6.7, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libinput.
