crítica
CVE-2026-50292
libinput: local privilege escalation via crafted uinput devices
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Amazon (alta), Azure Linux (alta), Red Hat (media), AlmaLinux (media), Oracle (media), Rocky Linux (media), Ubuntu (media).
Descripción
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | libinput, libinput-devel, libinput-utils | 1.30.1-2.el10_2 |
| amazon linux 2 | libinput, libinput-debuginfo, libinput-devel | 1.8.4-2.amzn2.0.1 |
| amazon linux 2023 | libinput, libinput-debuginfo, libinput-debugsource y 5 más | 1.26.2-1.amzn2023.0.2 |
| Azure Linux 3.0 | libinput | 0:1.25.0-2.azl3 |
| debian 11 | libinput | 1.16.4-3+deb11u1 |
| debian 12 | libinput | 1.22.1-1+deb12u1 |
| debian 13 | libinput | 1.28.1-1+deb13u1 |
| debian 14 | libinput | 1.31.3-1 |
| echo | libinput | 1.22.1-1+deb12u1 |
| rapidfort alma 10 | libinput, libinput-devel, libinput-utils | 1.30.1-2.el10_2 |
| rapidfort alma 8 | libinput, libinput-devel, libinput-utils | sin corrección indicada |
| rapidfort alma 9 | libinput, libinput-devel, libinput-utils | sin corrección indicada |
Mostrar las 55 entradas de 28 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | libinput | 1.30.1-2.el10_2 |
| alma 10 | libinput-devel | 1.30.1-2.el10_2 |
| alma 10 | libinput-utils | 1.30.1-2.el10_2 |
| amazon linux 2 | libinput | 1.8.4-2.amzn2.0.1 |
| amazon linux 2 | libinput-debuginfo | 1.8.4-2.amzn2.0.1 |
| amazon linux 2 | libinput-devel | 1.8.4-2.amzn2.0.1 |
| amazon linux 2023 | libinput | 1.26.2-1.amzn2023.0.2 |
| amazon linux 2023 | libinput-debuginfo | 1.26.2-1.amzn2023.0.2 |
| amazon linux 2023 | libinput-debugsource | 1.26.2-1.amzn2023.0.2 |
| amazon linux 2023 | libinput-devel | 1.26.2-1.amzn2023.0.2 |
| amazon linux 2023 | libinput-test | 1.26.2-1.amzn2023.0.2 |
| amazon linux 2023 | libinput-test-debuginfo | 1.26.2-1.amzn2023.0.2 |
| amazon linux 2023 | libinput-utils | 1.26.2-1.amzn2023.0.2 |
| amazon linux 2023 | libinput-utils-debuginfo | 1.26.2-1.amzn2023.0.2 |
| Azure Linux 3.0 | libinput | 0:1.25.0-2.azl3 |
| debian 11 | libinput | 1.16.4-3+deb11u1 |
| debian 12 | libinput | 1.22.1-1+deb12u1 |
| debian 13 | libinput | 1.28.1-1+deb13u1 |
| debian 14 | libinput | 1.31.3-1 |
| echo | libinput | 1.22.1-1+deb12u1 |
| rapidfort alma 10 | libinput | 1.30.1-2.el10_2 |
| rapidfort alma 10 | libinput-devel | 1.30.1-2.el10_2 |
| rapidfort alma 10 | libinput-utils | 1.30.1-2.el10_2 |
| rapidfort alma 8 | libinput | sin corrección indicada |
| rapidfort alma 8 | libinput-devel | sin corrección indicada |
| rapidfort alma 8 | libinput-utils | sin corrección indicada |
| rapidfort alma 9 | libinput | sin corrección indicada |
| rapidfort alma 9 | libinput-devel | sin corrección indicada |
| rapidfort alma 9 | libinput-utils | sin corrección indicada |
| rapidfort amazon linux 2023 | libinput | 1.26.2-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | libinput-devel | 1.26.2-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | libinput-test | 1.26.2-1.amzn2023.0.2 |
| rapidfort amazon linux 2023 | libinput-utils | 1.26.2-1.amzn2023.0.2 |
| rapidfort debian 12 | libinput | 0:1.28.1-1+deb13u1, 0:1.31.3-1 |
| rapidfort debian 13 | libinput | 0:1.28.1-1+deb13u1, 0:1.31.3-1 |
| rapidfort Oracle Linux 10 | libinput | 0:1.30.1-2.el10_2 |
| rapidfort Oracle Linux 10 | libinput-utils | 0:1.30.1-2.el10_2 |
| rapidfort Oracle Linux 9 | libinput | sin corrección indicada |
| rapidfort Oracle Linux 9 | libinput-utils | sin corrección indicada |
| rapidfort rocky 8 | libinput | sin corrección indicada |
| rapidfort rocky 8 | libinput-utils | sin corrección indicada |
| rapidfort rocky 9 | libinput | sin corrección indicada |
| rapidfort rocky 9 | libinput-utils | sin corrección indicada |
| rapidfort ubuntu 20.04 | libinput | 0:1.25.0-1ubuntu3.7 |
| rapidfort ubuntu 22.04 | libinput | 0:1.25.0-1ubuntu3.7 |
| rapidfort ubuntu 24.04 | libinput | 0:1.25.0-1ubuntu3.7 |
| Red Hat | libinput | sin corrección indicada |
| Red Hat | libinput-devel | sin corrección indicada |
| Red Hat | libinput-utils | sin corrección indicada |
| rocky 10 | libinput | 0.0.0 |
| rocky 10 | libinput-utils | 0.0.0 |
| ubuntu 20.04-ESM | libinput | 1.15.5-1ubuntu0.3+esm1 |
| ubuntu 22.04 | libinput | 1.20.0-1ubuntu0.4 |
| ubuntu 24.04 | libinput | 1.25.0-1ubuntu3.7 |
| ubuntu 26.04 | libinput | 1.31.1-1ubuntu1.2 |
Referencias
- https://access.redhat.com/errata/RHSA-2026:39296
- https://access.redhat.com/security/cve/CVE-2026-50292
- https://bugzilla.redhat.com/2485390
- https://bugzilla.redhat.com/show_bug.cgi?id=2485390
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50292
- https://errata.almalinux.org/10/ALSA-2026-39296.html
- https://errata.rockylinux.org/RLSA-2026:39296
Las 17 referencias
- https://gitlab.freedesktop.org/libinput/libinput/-/commit/76f0d8a7f57e2868882864b4611281f12f704b55
- https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296
- https://linux.oracle.com/cve/CVE-2026-50292.html
- https://linux.oracle.com/errata/ELSA-2026-39296.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-50292
- https://ubuntu.com/security/notices/USN-8602-1
- https://ubuntu.com/security/notices/USN-8753-1
- https://www.cve.org/CVERecord?id=CVE-2026-50292
- https://www.openwall.com/lists/oss-security/2026/06/04/5