CVE-2026-35094

NameCVE-2026-35094
DescriptionA flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libinput (PTS)bullseye1.16.4-3fixed
bookworm1.22.1-1fixed
trixie1.28.1-1fixed
forky, sid1.31.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libinputsourcebullseye(not affected)
libinputsourcebookworm(not affected)
libinputsourcetrixie(not affected)
libinputsource(unstable)(unfixed)

Notes

[trixie] - libinput <not-affected> (Vulnerable code not present)
[bookworm] - libinput <not-affected> (Vulnerable code not present)
[bullseye] - libinput <not-affected> (Vulnerable code not present)
https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1272
Fixed by: https://gitlab.freedesktop.org/libinput/libinput/-/commit/45506c7b3c8acbe36008975a2ae30d2c1eaf782f (1.31.1)
Fixed by: https://gitlab.freedesktop.org/libinput/libinput/-/commit/af041ea9ed725482e831fa1f6e33cbeb98fcc54f (1.30.3)

Search for package or bug name: Reporting problems