CVE-2026-35094

CVE-2026-35094 identifies a low-severity dangling pointer vulnerability within libinput, allowing an attacker with local access to deploy a malicious Lua plugin in specific system directories. This flaw can lead to information disclosure by printing a dangling pointer to system logs after a garbage collection cleanup, potentially exposing sensitive data if the memory location is re-used. Exploitation requires Lua plugins to be enabled in libinput and loaded by the compositor. Rated with a CVSS score of 3.3 (Low), there is currently no evidence of active exploitation, public exploit code, or significant community discussion or media coverage.