CVE-2026-50292 is a local privilege escalation vulnerability in libinput versions prior to 1.30.4 and 1.31.3. The flaw arises because libinput-device-group does not properly escape the phys output, allowing crafted input to inject arbitrary udev properties. This injection can lead to execution of arbitrary code with root privileges. The vulnerability is confirmed by Red Hat and Ubuntu advisories, which provide patched package versions to address the issue. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local attacker to escalate privileges to root by injecting arbitrary udev properties through crafted input devices. This can lead to full system compromise, including arbitrary code execution with administrative rights. The vulnerability affects multiple architectures and Linux distributions, including Red Hat Enterprise Linux 10.0 Extended Update Support and Ubuntu 20.04 LTS, 22.04 LTS, and later versions.

Official patches are available and should be applied promptly. Red Hat has released updated libinput packages (e.g., libinput-1.26.1-5.el10_0.1) addressing this vulnerability. Ubuntu provides fixed versions in libinput-bin, libinput-dev, and libinput10 packages for supported releases, including Ubuntu Pro for extended support versions. System administrators should update libinput packages via their standard system update mechanisms to remediate this issue. No additional mitigations are required beyond applying these updates.