High severity8.8NVD Advisory· Published Apr 1, 2026· Updated Apr 7, 2026
CVE-2026-35093
CVE-2026-35093
Description
A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the same permissions as the program using libinput, such as a graphical compositor. This could lead to the attacker monitoring keyboard input and sending that information to an external location.
Affected products
3cpe:2.3:o:fedoraproject:fedora:43:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:43:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:44:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- access.redhat.com/security/cve/CVE-2026-35093nvdThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
News mentions
4- Fedora Hummingbird brings the container security model to a Linux host OSHelp Net Security · May 12, 2026
- Copy.Fail Linux VulnerabilitySchneier on Security · May 12, 2026
- 11th May – Threat Intelligence ReportCheck Point Research · May 11, 2026
- 'Dirty Frag' Linux flaw one-ups CopyFail with no patches and public root exploitThe Register Security · May 8, 2026