Nixpkgs security tracker
Permalink
CVE-2026-50265
7.0 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Libinput: local privilege escalation via crafted uinput devices
A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVE_CMD properties that are executed when a device is removed. This vulnerability allows an attacker to gain elevated privileges on the system.
References
Affected products
libinput
Matching in nixpkgs
pkgs.libinput
Handles input devices in Wayland compositors and provides a generic X.Org input driver
pkgs.gebaar-libinput
Gebaar, A Super Simple WM Independent Touchpad Gesture Daemon for libinput
pkgs.libinput-gestures
Gesture mapper for libinput
pkgs.xf86inputlibinput
None
pkgs.xf86-input-libinput
libinput-based input driver for the Xorg X server