A critical code injection vulnerability in libinput on Red Hat Enterprise Linux platforms permits local attackers to gain unauthorized code execution and compromise system input data.

This flaw stems from CWE-94, which is improper control of code generation. A local attacker with low privileges can place a crafted Lua bytecode file in system or user configuration directories to trigger code execution with the permissions of the graphical compositor.

The ability for a local attacker to execute arbitrary code with the privileges of a graphical compositor poses a severe security risk to the integrity and confidentiality of the entire workstation. Successful exploitation allows for the interception of sensitive input data, including keystrokes, which may lead to the exposure of credentials and proprietary information. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires prompt attention to prevent lateral movement or data exfiltration.

Immediate Action: Apply the latest security updates provided by Red Hat for the libinput package across all affected RHEL versions.

Proactive Monitoring: Audit system and user configuration directories for unexpected or unauthorized Lua bytecode files that do not align with standard deployment configurations.

Compensating Controls: Restrict write access to system configuration directories to authorized administrative accounts only to prevent the placement of malicious files.

Public Exploit Available: Unknown.

Organizations running Red Hat Enterprise Linux should prioritize the deployment of the vendor-supplied patches for libinput. Because this flaw allows for unauthorized code execution, the risk of data theft through keystroke monitoring is significant for multi-user or shared systems. Administrators must verify that all instances are updated to the latest available package versions to mitigate this threat effectively.