In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
1.0.1-1ubuntu11.1.0-1ubuntu11.1.0-1ubuntu21.1.3-1ubuntu11.1.4-1ubuntu11.1.4-1ubuntu21.2.2-1ubuntu11.2.3-1ubuntu11.6.3-1ubuntu1~16.04.11.10.0-11.10.1-11.10.3-21.10.4-11.10.4-1ubuntu0.18.04.11.10.4-1ubuntu0.18.04.21.10.4-1ubuntu0.18.04.31.8.2-1ubuntu21.9.2-11.9.3-1+3 more1.20.0-1ubuntu0.41.23.0-21.23.0-2.11.25.0-11.25.0-1ubuntu11.25.0-1ubuntu21.25.0-1ubuntu31.25.0-1ubuntu3.11.25.0-1ubuntu3.21.25.0-1ubuntu3.31.25.0-1ubuntu3.4+2 more1.27.1-11.28.1-11.28.1-1build11.28.1-1ubuntu0.11.28.1-1ubuntu0.21.28.1-1ubuntu0.31.28.1-1ubuntu0.41.28.1-1build11.28.1-1ubuntu21.30.0-11.30.1-11.31.0-11.31.0-1ubuntu0.11.31.1-11.31.1-1ubuntu11.31.1-1ubuntu1.11.15.5-1ubuntu0.3+esm1Exploitability
AV:LAC:HPR:NUI:NScope
S:UImpact
C:HI:HA:HCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H