A flaw in libinput permits an attacker who can place a Lua plugin file in particular system directories to trigger a dangling pointer during garbage‑collection cleanup. The exposed pointer is written to system logs, which may subsequently be recycled for another purpose. If the memory region is re‑used, this can reveal sensitive data that was once contained in that region. The issue is classified under CWE‑825 and results in potential information disclosure.

Red Hat Enterprise Linux distributions (versions 10, 7, 8, and 9) are affected because they include the vulnerable libinput component. The vulnerability arises when Lua plugins are enabled in libinput and the compositor loads them. Anyone managing these RHEL systems should be aware that any installation of libinput with Lua plugin support is potentially exposed.

The CVSS score is 3.3, indicating low severity, and the vulnerability is not currently listed in CISA’s KEV catalog. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified precisely, but the need to upload a Lua plugin file suggests a local or privileged attacker is required. The exploit path therefore appears constrained to environments where Lua plugins are enabled and write access to the plugin directories is possible. Because the vulnerability leads only to log exposure and does not allow direct code execution, the overall risk remains low, though it still warrants screening of logging output for inadvertent disclosures.