The vulnerability stems from a dangling pointer in libinput’s Lua plugin handling. When the garbage‑collection cleanup function is called, a pointer to freed memory remains. If that memory is subsequently reused, the pointer value can be written to system logs, exposing sensitive data that previously resided there. Because the exploitation occurs during normal log writing, the primary impact is information disclosure, potentially revealing confidential information stored in the temporarily freed memory region.

The flaw affects all Red Hat Enterprise Linux releases 7 through 10 that ship the vulnerable libinput package. The same vulnerability also impacts Fedora 43 and 44 since they use the upstream libinput library. Specific affected versions are not enumerated in the advisory, so any installation of libinput that has not been upgraded to the patched release should be considered vulnerable.

The CVSS v3.1 score of 3.3 indicates low severity, and the EPSS score of less than 1 % shows a very small likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The attack requires that the attacker can deploy a Lua plugin file in a system directory and that the compositor loads Lua plugins. This implies a local privilege escalation or compromised application scenario; a remote attacker would need higher level access. Because the vulnerability is an information‑disclosure issue with no known exploitation code, the risk remains low but not negligible for environments that expose Lua plugins and write logs.