CVE-2026-50260: X.Org X server and Xwayland use-after-free in FreeCounter

CVE-2026-50260 · Severity: high · CVSS 7.8 · Published 2026-06-05

A security vulnerability has been identified in the X.Org X server and Xwayland, which are core components used to manage graphical displays on Linux and Unix-like systems. An attacker with local access to a system could exploit this flaw to crash the display server or potentially gain administrative (root) privileges. This could lead to a complete system takeover or a denial of service for all users on the affected machine.

Technologies: X.Org Foundation X Server, X.Org Foundation Xwayland. Vendors: X.Org Foundation.

Quick answers

Is CVE-2026-50260 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50260 being exploited in the wild.
How severe is CVE-2026-50260?
High severity, with a CVSS score of 7.8, published 5 June 2026.
Which products and versions are affected?
X.Org Foundation X Server < 21.1.23; X.Org Foundation Xwayland < 24.1.12.
Is there a fix for CVE-2026-50260?
A patch was published on 2026-04-20: Upstream fix committed to GitLab by Peter Hutterer. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50260 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-50260?
Check whether you run X.Org Foundation X Server or X.Org Foundation Xwayland at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the FreeCounter() function of the X.Org X server and Xwayland. The flaw is triggered when a client sets up multiple SyncCounters and awaits triggers; if a second client connection destroys these counters, the server may attempt to access memory that has already been freed. This occurs because the CounterDestroyed callback can free the SyncAwaitUnion structure while other triggers in the same group still reference it. An attacker with local access can exploit this to crash the X server or achieve local privilege escalation if the server is running with root privileges. Patches are available in xorg-server 21.1.23 and xwayland 24.1.12.

Affected products

  • X.Org X server < 21.1.23
  • X.Org Xwayland < 24.1.12

Timeline

  • 2026-04-20: patched: Upstream fix committed to GitLab by Peter Hutterer.
  • 2026-06-02: advisory: X.Org security advisory published.
  • 2026-06-05: disclosed: CVE-2026-50260 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.