Ubuntu alert USN-8602-1 (libinput)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8602-1] libinput vulnerability
Date:
             
 
Thu, 30 Jul 2026 14:59:13 +0000
Message-ID:
             
 
<E1wpSE5-00071p-C9@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8602-1
July 23, 2026

libinput vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

libinput could be made to run programs as an administrator.

Software Description:
- libinput: Input device management and event handling library

Details:

It was discovered that libinput did not properly escape device
properties. A local attacker could possibly use this issue to inject
arbitrary udev properties and execute arbitrary code as root.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  libinput-bin                    1.20.0-1ubuntu0.4
  libinput-dev                    1.20.0-1ubuntu0.4
  libinput10                      1.20.0-1ubuntu0.4

Ubuntu 20.04 LTS
  libinput-bin                    1.15.5-1ubuntu0.3+esm1
                                  Available with Ubuntu Pro
  libinput-dev                    1.15.5-1ubuntu0.3+esm1
                                  Available with Ubuntu Pro
  libinput10                      1.15.5-1ubuntu0.3+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8602-1
  CVE-2026-50292

Package Information:
  https://launchpad.net/ubuntu/+source/libinput/1.20.0-1ubu...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpiaQ4ACgkQcpJm3tlz
hgE30Q//eN0ePMME8jTfttsbxY1ClrXv8e7lLLpRgBveWClDrKo92zdnPMkTO2gI
fSPccYZNTt9OemHrLvTgVaeQ6YzO+DFciOA6jdlCItF0iZQMbXNqKhmq5NXTapaU
nmi3MEy0h+1hJbMGeGZ3ixJGxVHNnZ//T7xw4Tw78AemRV/r8D4711us5GAalBS0
1/1XaqJ97F5FcwKv1BNGuKfTeL0ms6poT2W1GdEVr+4188fUyaGgv6DpbJYaeqeB
vioQhPfOPuJqcM5Wazbw3J7KJ/fI+kL4Y/oClG6TPLWBEdW90npceOhaDlnjHl6r
LTfzgRxIgrTBzkHdpXxuIOxM2qHk8jJpzHkodpWyt1JhNKNM6e1NSl3FLekXCK/Y
zIpup9Sq+rOt0PHARwttzFrQ4BnuWQXO/0icB1MRtLBb+wQlQIlxXXzIvoL1l/hJ
FzAq4jP0h5MVT0xpxA1zkY62wJFjaVvERCJlBGnosGSVegckV7iQo9WmIEYT2Bug
TlrgqPrW3fQzSRJatBduKqid2rV3i0IXPcxa/dAySMCg6uV63Yb3coa7lnWh5Czr
+VihJhN5xtc/h5Ngw1pAvOGjHO4g3pRICd3N2uJ200YtI8XDQ2Jf6VKYKpzVDFDp
ypeCy0rQOUCk+fHKIOwEocL7g2o/W5gGbOuFH7JQijaxMpd+g7Y=
=Z1VP
-----END PGP SIGNATURE-----