CVE-2026-35094

A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-26)

CWE

CWE-825

Published

2026-04-01

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• fedoraproject:fedora
• freedesktop:libinput

References

• https://access.redhat.com/security/cve/CVE-2026-35094
• https://bugzilla.redhat.com/show_bug.cgi?id=2453840
• https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1272

Check your stackJSON