CVE-2026-35094
A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. This occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used, leading to information disclosure. For this exploit to work, Lua plugins must be enabled in libinput and loaded by the compositor.
Scoring
- Severity
- LOW
- CVSS base score
- 3.3
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS probability
- 0.14%
- CWE
- CWE-825
- Published
- 2026-04-01
- Last modified
- 2026-04-01
Weakness type
Related vulnerabilities
- CVE-2026-77220 — PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting
- CVE-2026-76891 — Expired Pointer Dereference in Wireshark
- CVE-2026-76890 — Expired Pointer Dereference in Wireshark
- CVE-2026-17523 — can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet
- CVE-2026-10671 — User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)
- CVE-2026-54778 — CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
- CVE-2026-58592 — Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration
- CVE-2026-12610 — Sssd: use-after-free crash in sssd' 'sssd_pam' process