CVE-2026-35093: 
NixOS vulnerability analysis and mitigation

CVE-2026-35093 is a code injection vulnerability in libinput that allows a local attacker to execute unauthorized code by placing a specially crafted Lua bytecode file in certain system or user configuration directories. The flaw affects libinput versions prior to 1.30.3 and from 1.30.4 up to (but not including) 1.31.1, and specifically impacts Fedora 43 and 44 where libinput is compiled with -Dautoload-plugins enabled. It was disclosed on April 1, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): libinput loads Lua plugins from directories such as /usr/share/libinput/plugins, /etc/libinput/plugins, and $XDG_CONFIG_HOME/libinput/plugins without verifying the integrity or authenticity of Lua bytecode files at runtime. Because Lua bytecode bypasses the sandboxing restrictions that apply to Lua source scripts, an attacker who can write a pre-compiled Lua bytecode file to one of these directories can execute arbitrary code within the process that uses libinput — typically the graphical compositor. The exploit requires that Lua plugins be enabled in libinput (automatic on Fedora 43/44 with -Dautoload-plugins) and, for the XDG_CONFIG_HOME path, that the compositor explicitly enables user-level plugin loading (e.g., mutter 50 does this) (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows a low-privileged local attacker to run arbitrary code with the same permissions as the graphical compositor or any other process using libinput, resulting in high confidentiality, integrity, and availability impact with a changed scope. The most notable consequence is the ability to silently monitor all keyboard input (including passwords and sensitive data) and exfiltrate it to an external location. Because the code runs under compositor privileges, the attacker may also manipulate graphical sessions, access other user data, or pivot to further compromise the system (Red Hat CVE, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.015–0.023%, placing it in a low percentile for near-term exploitation likelihood (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to write files to specific configuration directories, limiting the attack surface compared to remote vulnerabilities.

1. Gain local access: Obtain a low-privileged local user account on a system running Fedora 43 or 44 with libinput compiled with -Dautoload-plugins (the default for these Fedora releases).
2. Identify target plugin directories: Determine which plugin directories are loaded by the compositor — typically /usr/share/libinput/plugins, /etc/libinput/plugins (require elevated write access), or $XDG_CONFIG_HOME/libinput/plugins (writable by the user if the compositor enables it, e.g., mutter 50).
3. Craft malicious Lua bytecode: Write a Lua script that performs the desired malicious action (e.g., hooking keyboard event callbacks to capture keystrokes and send them to an external server), then compile it to Lua bytecode using luac to bypass source-level sandboxing restrictions.
4. Deploy the bytecode file: Place the compiled .luac bytecode file into the accessible plugin directory (most likely $XDG_CONFIG_HOME/libinput/plugins/malicious.luac).
5. Trigger plugin load: Wait for or trigger a compositor restart or libinput re-initialization. The compositor (e.g., GNOME Shell with mutter 50) will automatically load all plugins from the configured directories, executing the malicious bytecode within the compositor process.
6. Achieve objective: The malicious code runs with compositor-level privileges, enabling keylogging, data exfiltration, or further system compromise (Red Hat Bugzilla, GitHub Advisory).

• File System: Unexpected .lua or .luac files in /usr/share/libinput/plugins/, /etc/libinput/plugins/, or $XDG_CONFIG_HOME/libinput/plugins/ (e.g., ~/.config/libinput/plugins/); files with recent modification timestamps inconsistent with system package updates.
• Network: Unusual outbound connections from the compositor process (e.g., gnome-shell, mutter, sway) to external IP addresses or domains, particularly on non-standard ports; DNS queries for unknown domains initiated by compositor processes.
• Process: Unexpected network-related child processes or threads spawned by the compositor; compositor process making system calls inconsistent with normal operation (e.g., connect(), sendto() to external addresses).
• Logs: System logs (journald/syslog) showing libinput loading plugin files not installed by the package manager; audit logs recording writes to libinput plugin directories by non-root users.

The vulnerability is fixed in libinput versions 1.30.3 and 1.31.1; users should update to these versions via their distribution's package manager (Red Hat Bugzilla). Fedora 43 and 44 users should apply available updates through dnf update libinput. As a workaround, restrict write permissions on libinput plugin directories (/usr/share/libinput/plugins, /etc/libinput/plugins) to prevent unauthorized file placement, and disable user-level plugin loading in the compositor configuration if not required. Administrators should also audit existing plugin directories for unexpected files and monitor them for changes using file integrity monitoring tools (Red Hat CVE).

Phoronix covered the vulnerability with an article on libinput's Lua security issues, noting the significance of the bytecode bypass (Phoronix). The Wayland developer mailing list (freedesktop.org) also carried discussion of the fix (Wayland Devel List). The Hacker Wire published a write-up on the local code execution mechanism (The Hacker Wire). The oss-security mailing list received a disclosure post, and openSUSE issued a security announcement for affected packages (openSUSE Security).