CVE-2026-50265: Libinput: local privilege escalation via crafted uinput devices

Synopsis

A local privilege escalation vulnerability exists in libinput, the input device handling library used on Linux systems. A local attacker who already has access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper, including REMOVE_CMD properties that are executed as root when a device is removed. Successful exploitation gives the attacker full root-level code execution on the host. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  A low-privilege local account is sufficient; the attacker does not need administrative credentials, but must have an authenticated session on the system.

• Victim interactionNot required

  No user interaction is required; the attacker can carry out the full exploit without any action from another user.

• Attack complexityDetail

  Attack complexity is high, meaning the exploit depends on environmental factors or timing conditions (such as the precise moment a uinput device is removed) that the attacker cannot fully control and may need to repeat.

Blast Radius

• Attacker executes arbitrary code as root by abusing a REMOVE_CMD udev property triggered on device removal.
• Full read access to all files and secrets on the host, including credentials, private keys, and container runtime socket tokens.
• Full write access to the filesystem, allowing the attacker to modify binaries, install backdoors, or alter audit logs.
• Complete denial of service is achievable by crashing or killing any process, including the container runtime or init system.