CVE-2026-35094Libinput: libinput: information disclosure via dangling pointer in lua plugin handling

Descripción

A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://access.redhat.com/security/cve/CVE-2026-35094 vdb-entryThird Party AdvisoryVDB Entry
• RHBZ#2453840 issue-trackingIssue TrackingThird Party Advisory
• https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1272 Broken Link