Junglewise Threat Intelligence

CVE-2026-50261: X.Org X server use-after-free in SyncChangeCounter

CVE-2026-50261 · Severity: high · CVSS 7.8 · Published 2026-06-05

Technologies: X.Org Foundation Xwayland, X.Org Foundation X.Org Server. Vendors: X.Org, X.Org Foundation.

Executive brief

A security vulnerability has been identified in the X.Org X server and Xwayland, which are fundamental components used to manage graphical displays and user input on Linux systems. An attacker with local access to the system can exploit this flaw to crash the display server or potentially gain elevated administrative privileges. This could lead to a complete system takeover or a denial of service for all users on the affected machine.

Technical details

A use-after-free vulnerability exists in the X.Org X server and Xwayland within the SyncChangeCounter() function. The root cause is a failure to properly handle trigger list iteration when a trigger fires; specifically, the TriggerFired call can invoke FreeResource/FreeAwait, which unlinks and frees trigger list nodes, potentially including the next node in the current iteration. An attacker can exploit this by setting up multiple SyncCounters and using a second client connection to destroy them while they are being modified. This can result in a server crash or local privilege escalation if the X server is running with root privileges. The issue is fixed in xorg-server 21.1.23 and xwayland 24.1.12 by restarting the list iteration from the head after a trigger fires.

Affected products

  • X.Org xorg-x11-server <= 21.1.22
  • X.Org xorg-x11-server-Xwayland <= 24.1.9

Timeline

  • 2026-04-20: other: Fix authored upstream
  • 2026-06-02: advisory: X.Org security advisory released
  • 2026-06-05: disclosed: CVE published and NVD record created

References

Related threats