This vulnerability in libinput allows a local attacker with access to /dev/uinput to inject arbitrary udev properties through the libinput-device-group helper. Specifically, the attacker can exploit REMOVE_CMD properties that execute commands when a device is removed, resulting in potential root code execution. This leads to privilege escalation on Red Hat Enterprise Linux 10 systems. The CVSS 3.1 vector indicates the attack requires local access with high attack complexity and low privileges but no user interaction, impacting confidentiality, integrity, and availability at a high level. The vendor advisory does not currently specify a patch or remediation status.

Successful exploitation allows a local attacker to execute arbitrary commands as root, leading to full system compromise. This includes elevated privileges from a low-privilege local account, affecting system confidentiality, integrity, and availability. No known exploits are reported in the wild, but the impact of exploitation is severe due to root code execution.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-50265 for current remediation guidance. Until an official fix is available, restrict local access to /dev/uinput to trusted users only and monitor for unusual device removal commands. Avoid running untrusted code with access to device interfaces. Follow vendor updates closely for patches or official mitigations.