In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
1.0.1-1ubuntu11.1.0-1ubuntu11.1.0-1ubuntu21.1.3-1ubuntu11.1.4-1ubuntu11.1.4-1ubuntu21.2.2-1ubuntu11.2.3-1ubuntu11.6.3-1ubuntu1~16.04.11.10.0-11.10.1-11.10.3-21.10.4-11.10.4-1ubuntu0.18.04.11.10.4-1ubuntu0.18.04.21.10.4-1ubuntu0.18.04.31.8.2-1ubuntu21.9.2-11.9.3-1+3 more1.14.1-21.14.2-11.14.3-11.14.3-1build11.15.1-11.15.2-11.15.3-11.15.4-11.15.5-11.15.5-1ubuntu0.1+2 more1.27.1-11.28.1-11.28.1-1build11.28.1-1ubuntu0.11.28.1-1ubuntu0.21.28.1-1ubuntu0.31.28.1-1ubuntu0.4Exploitability
AV:LAC:HPR:NUI:NScope
S:UImpact
C:HI:HA:HCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H