Junglewise Threat Intelligence

CVE-2026-50260: X.Org X server and Xwayland use-after-free in FreeCounter

CVE-2026-50260 · Severity: high · CVSS 7.8 · Published 2026-06-05

Technologies: X.Org Foundation X Server, X.Org Foundation Xwayland. Vendors: X.Org Foundation, X.Org.

Executive brief

A security vulnerability has been identified in the X.Org X server and Xwayland, which are core components used to manage graphical displays on Linux and Unix-like systems. An attacker with local access to a system could exploit this flaw to crash the display server or potentially gain administrative (root) privileges. This could lead to a complete system takeover or a denial of service for all users on the affected machine.

Technical details

A use-after-free vulnerability exists in the FreeCounter() function of the X.Org X server and Xwayland. The flaw is triggered when a client sets up multiple SyncCounters and awaits triggers; if a second client connection destroys these counters, the server may attempt to access memory that has already been freed. This occurs because the CounterDestroyed callback can free the SyncAwaitUnion structure while other triggers in the same group still reference it. An attacker with local access can exploit this to crash the X server or achieve local privilege escalation if the server is running with root privileges. Patches are available in xorg-server 21.1.23 and xwayland 24.1.12.

Affected products

  • X.Org X server < 21.1.23
  • X.Org Xwayland < 24.1.12

Timeline

  • 2026-04-20: patched: Upstream fix committed to GitLab by Peter Hutterer.
  • 2026-06-02: advisory: X.Org security advisory published.
  • 2026-06-05: disclosed: CVE-2026-50260 published.

References

Related threats