libinput is a system component that manages input devices on Linux systems. A flaw in the libinput-device-group helper permits a local attacker who can access the character device /dev/uinput to inject arbitrary udev properties. This injection can cause the system to execute commands associated with REMOVE_CMD properties whenever a device is removed, allowing the attacker to run code as root. The vulnerability thus enables privilege escalation from an unprivileged user to superuser privileges. This vulnerability represents an OS command‑injection flaw (CWE‑78).

The affected operating systems are Red Hat Enterprise Linux 7, 8, 9, and 10, all of which ship the vulnerable libinput version and expose /dev/uinput. The flaw is relevant when packages such as steam-device, antimicrox, or kdeconnectd install udev rules that allow a logged‑in user to create uinput devices, thereby granting non‑root write access to /dev/uinput.

The CVSS score of 7 indicates a high severity vulnerability, while the EPSS score is not available. The vulnerability is not listed in CISA KEV. The attack vector is inferred as local because exploitation requires access to /dev/uinput, a device normally restricted to privileged users. A local attacker who can write to /dev/uinput may construct a uinput event that carries malicious REMOVE_CMD properties; when the kernel processes the removal event, those commands are executed as root, enabling an attacker to obtain superuser privileges.