A corrective release has been published libinput 1.31.3 — a library for input device handling used by modern Linux desktops in conjunction with Wayland compositors and X.Org. libinput is responsible for device detection, event processing, and input abstraction: from mice and touchpads to graphic tablets. The project is distributed under the MIT license.
The main change in this release is a vulnerability fix in the udev helper program libinput-device-group. The issue was related to the PHYS value obtained from the device being outputted to udev as a KEY=VALUE string without proper sanitization of special characters. A malicious device created through uinput or uhid, could inject a newline character into PHYS, causing udev to interpret the output as two separate variables. This could potentially lead to arbitrary code execution with root privileges.
The vulnerability is not remote: an attacker needs local access and the ability to create a malicious uinput or uhid device. Usually, access to such interfaces is restricted to root, but the risk arises on systems with broader udev rules. For example, configurations that allow regular users access to support game controllers and Steam Input, such as through the package steam-devices or similar rules.
Important clarification: earlier news mentioned version libinput 1.31.2, but the official advisory lists the fixed versions as libinput 1.31.3 and 1.30.4. Versions up to 1.31.2 and 1.30.3 inclusive are affected; a CVE had not yet been assigned at the time of publication.
Users are advised to update the system package libinput through the distribution's package manager. In Arch Linux the package libinput 1.31.3-1 has already appeared in the Extra repository on June 4, 2026, while in Debian, the version 1.31.3-1 was accepted into unstable on the same day.
Source: linux.org.ru
