Junglewise Threat Intelligence

CVE-2025-62230: X.Org X server use-after-free in Xkb client resource removal

CVE-2025-62230 · Severity: high · CVSS 7.3 · Published 2025-10-30

Technologies: X.Org Foundation X Server, Red Hat Enterprise Linux 8, X.Org Foundation Xwayland, Red Hat Enterprise Linux 9. Vendors: X.Org, X.Org Foundation, Red Hat.

Executive brief

A vulnerability was found in the X.Org X server, a fundamental component used to manage graphical displays and keyboard input on Linux and Unix-like systems. A flaw in how the system cleans up keyboard resources when a user or application disconnects can lead to memory corruption. In practice, a local attacker could exploit this to crash the graphical interface or potentially gain unauthorized access to sensitive information stored in memory.

Technical details

A use-after-free vulnerability exists in the X.Org X server’s X Keyboard (Xkb) extension. The root cause is a failure to properly detach related resources before freeing data structures during client resource cleanup. A local attacker with the ability to connect to the X server can trigger this condition by disconnecting a specially crafted client, leading to memory corruption or a denial-of-service (crash). While primarily impacting availability, the memory corruption could potentially be leveraged for local privilege escalation or information disclosure. Patches have been released by X.Org and major Linux distributions including Red Hat and Debian.

Affected products

  • X.Org X server < 21.1.14
  • X.Org Xwayland < 24.1.4
  • Red Hat Enterprise Linux 8 xorg-x11-server-Xwayland < 21.1.3-19.el8_10
  • Red Hat Enterprise Linux 9 xorg-x11-server < 1.20.11-32.el9_6

Timeline

  • 2025-10-28: disclosed: Public disclosure on oss-security mailing list
  • 2025-10-30: advisory: NVD publication date
  • 2025-11-03: patched: Red Hat released security updates (RHSA-2025:19432)

References

Related threats