Dangling Pointer Vulnerability in libinput Affects Red Hat and Other Distributions
CVE-2026-35094

3.3LOW

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9
Vendor: CVE Published:; 1 April 2026

What is CVE-2026-35094?

A vulnerability exists in libinput that allows an attacker to exploit a dangling pointer issue if they can deploy a Lua plugin in specific system directories. This issue arises during garbage collection cleanup, which can leave a pointer invalid and subsequently logged by the system. If such a pointer points to re-used memory, it could lead to the disclosure of sensitive information. To be vulnerable, Lua plugins must be enabled and loaded by the compositor, highlighting the importance of restricting access to system directories where these plugins are installed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch