CVE-2026-35094: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-35094 is an information disclosure vulnerability in libinput caused by a dangling pointer in Lua plugin handling. An attacker who can deploy a malicious Lua plugin file into specific system directories (/usr/share/libinput/plugins, /etc/libinput/plugins, or XDG_CONFIG_HOME/libinput/plugins) can trigger a garbage collection cleanup function that leaves a dangling pointer, which may then be printed to system logs, potentially exposing sensitive memory contents. The vulnerability was published on April 1, 2026, and affects libinput as shipped in Fedora 43 and 44 (compiled with -Dautoload-plugins); no current RHEL versions are affected. It carries a CVSS v3.1 base score of 5.5 (Medium) per Red Hat's assessment, or 3.3 (Low) per the ENISA/GitHub Advisory scoring (Red Hat CVE, GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-825 (Expired Pointer Dereference): when a Lua plugin's garbage collection (GC) cleanup function is invoked, a pointer to previously valid memory is not properly nullified, leaving it in a dangling state. If that memory location is subsequently reused, the stale pointer value — which may reference sensitive data — can be printed to system logs by libinput. Exploitation requires local access with low privileges, the ability to write a Lua plugin file to one of the directories scanned by libinput, Lua plugin support compiled into libinput (e.g., via -Dautoload-plugins as in Fedora 43/44), and the compositor loading those plugins (e.g., mutter 50 loads from XDG_CONFIG_HOME) (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation results in information disclosure: sensitive data residing at the reused memory location may be exposed through system logs, which could be read by the attacker or other local users with log access. There is no impact on integrity or availability. The scope is limited to the local system, and lateral movement potential is low; however, leaked memory contents could include credentials, session tokens, or other sensitive runtime data depending on memory layout at the time of exploitation (Red Hat CVE, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.011–0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for local access, write permissions to plugin directories, and a specific libinput build configuration, significantly limiting the attack surface (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Confirm the target system runs Fedora 43 or 44 with libinput compiled with -Dautoload-plugins, and that a compositor loading Lua plugins (e.g., mutter 50) is active.
2. Gain local access: Obtain a low-privileged local user account on the target system.
3. Deploy malicious Lua plugin: Write a crafted Lua plugin file to one of the directories scanned by libinput — /usr/share/libinput/plugins/, /etc/libinput/plugins/ (requires elevated write access), or $XDG_CONFIG_HOME/libinput/plugins/ (user-writable if compositor enables it).
4. Trigger GC cleanup: Cause libinput to load and then unload the plugin, invoking the Lua garbage collection cleanup function, which leaves a dangling pointer.
5. Read system logs: Monitor system logs (e.g., /var/log/messages, journald) for entries where libinput prints the dangling pointer value, which may reference sensitive memory contents if the memory location has been reused (Red Hat Bugzilla, GitHub Advisory).

• File System: Unexpected or unfamiliar .lua files appearing in /usr/share/libinput/plugins/, /etc/libinput/plugins/, or $XDG_CONFIG_HOME/libinput/plugins/; file timestamps inconsistent with system package installation dates.
• Logs: Unusual libinput log entries containing raw pointer addresses or garbled memory content in journald or syslog; repeated plugin load/unload cycles in libinput debug output.
• Process: Unexpected processes writing to libinput plugin directories; compositor processes (e.g., mutter, gnome-shell) exhibiting unusual log verbosity related to plugin handling.

The vulnerability specifically affects Fedora 43 and 44 and does not affect any current RHEL version. Patches have been tracked via the Red Hat Bugzilla and upstream libinput issue tracker. Immediate mitigations include: (1) disabling Lua plugin support in libinput if not required (recompile without -Dautoload-plugins); (2) restricting write access to plugin directories (/usr/share/libinput/plugins/, /etc/libinput/plugins/) to privileged users only; (3) configuring the compositor to not load plugins from XDG_CONFIG_HOME; and (4) applying available distribution updates for Fedora 43/44 as they become available. OpenSUSE and Yocto Project have also issued security updates addressing this issue (Red Hat Bugzilla, OpenSUSE Security).

Phoronix covered the libinput Lua security issues, noting the niche but real risk introduced by the Lua plugin subsystem (Phoronix). The upstream libinput maintainer Peter Hutterer confirmed via Red Hat Bugzilla that the issue is limited to Fedora 43 and 44 and does not affect RHEL, helping to contextualize the limited scope. Discussion on the oss-security mailing list and the wayland-devel list also addressed the vulnerability alongside the related CVE-2026-35093 sandbox escape issue (oss-sec, wayland-devel).