Local root code execution via newline injection

CRLF injection in libinput before 1.30.4 and 1.31.0 through 1.31.2 allows local users to execute arbitrary code as root. The libinput-device-group udev helper prints an unescaped device phys sysattr as a KEY=VALUE property, so an embedded newline creates an attacker-controlled second property. Exploitation requires permission to create a malicious uinput or uhid device; custom uaccess rules can grant that permission to a logged-in seat user, enabling properties such as REMOVE_CMD to run as root.