Junglewise Threat Intelligence

CVE-2026-50257: X.Org X server and Xwayland use-after-free in miSyncDestroyFence

CVE-2026-50257 · Severity: high · CVSS 7.8 · Published 2026-06-05

Vendors: X.Org.

Executive brief

A security vulnerability has been identified in the X.Org X server and Xwayland, which are core components used to manage graphical displays on Linux and Unix-like systems. An attacker with local access to a system can exploit this flaw to crash the display server or potentially gain elevated administrative (root) privileges. This could lead to a complete system takeover or a denial of service for all users on the affected machine.

Technical details

A use-after-free (UAF) vulnerability exists in the miSyncDestroyFence() and FreeCounter() functions within the X.Org X server and Xwayland. The flaw is triggered when a client sets up multiple fence triggers or sync counters and then uses a second X connection to destroy the sync object while the first connection is still awaiting it. This causes the CounterDestroyed callback to free memory (SyncAwaitUnion) that is still referenced by subsequent iterations of the trigger list, leading to a function pointer call on freed memory. A local attacker can exploit this to crash the server or achieve privilege escalation if the X server is running with root privileges. The issue is fixed in xorg-server-21.1.23 and xwayland-24.1.12.

Affected products

  • X.Org X.Org X server <= 21.1.22
  • X.Org Xwayland <= 24.1.9

Timeline

  • 2026-06-02: advisory: X.Org security advisory released.
  • 2026-06-05: disclosed: CVE-2026-50257 published.

References