Loading story…
A vulnerability in libinput, the input device handling library used with Wayland and X.Org Server, can allow local privilege escalation to root by abusing how the library passes device attributes into udev. Researchers found that crafted newline characters in values associated with virtual devices created through uinput or uhid can inject unintended extra udev properties, including dangerous keys such as REMOVE_CMD, potentially leading to command execution as root when the device is processed or removed.
The issue affects systems where non-root users can write to /dev/uinput or /dev/uhid, a capability that is normally restricted but may be exposed by permissive desktop-oriented udev rules or group memberships. Fedora was highlighted as an example where packages such as steam-devices, antimicrox, and kdeconnectd may open that path for local users. The vulnerability has been fixed in libinput 1.31.3 and 1.30.4, and exploitation requires local access plus the ability to create malicious virtual input devices.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Debian published security advisory DSA 6339-1 for libinput, announcing a distribution-level security update addressing the libinput vulnerability tracked as CVE-2026-50265. This represents downstream remediation by the Debian project following the upstream fix and CVE assignment.
The previously disclosed libinput vulnerability was subsequently assigned CVE-2026-50265. The issue affects libinput versions up to 1.31.2 and 1.30.3 and can allow root-level code execution via injected udev properties from crafted uinput or uhid devices.
The vulnerability was fixed in libinput releases 1.31.3 and 1.30.4. The fix addresses unsafe handling of udev properties that could otherwise be abused for command execution as root.
A vulnerability in libinput was disclosed that can allow local privilege escalation to root by injecting additional udev properties through crafted virtual input device attributes via uinput or uhid. The issue affects systems where non-root users can access /dev/uinput or /dev/uhid through permissive rules or group membership.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
8 references tracked. Mallory keeps watching after this page renders.
lists.debian.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcelore.freedesktop.org
Open sourceseclists.org
Open sourcegitlab.freedesktop.org
Open sourceopennet.me
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026
Multiple Linux kernel HID and force-feedback drivers contained out-of-bounds write vulnerabilities tracked as **CVE-2019-19532**. A malicious USB HID device could trigger the flaws on kernels earlier than `5.3.9`, affecting drivers for force-feedback hardware from vendors including Logitech, Microsoft, Sony, and Holtek. The upstream fix in commit `d9d4b1e46d95` validates that a HID device has input entries before drivers access the first `hid_input` structure. Drivers now log “no inputs found” and return `-ENODEV` for malformed devices, preventing invalid list access that could cause kernel crashes or denial of service. Organizations using affected Linux kernels should deploy kernel `5.3.9` or applicable vendor security updates from Ubuntu, Debian, or openSUSE.
Aug 28, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026