# CVE-2026-50261: X.Org X server use-after-free in SyncChangeCounter

Source: https://junglewise.ai/threats/cve-2026-50261-x-org-x-server-use-after-free-in-syncchangecounter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-50261 · Severity: high · CVSS 7.8 · Published 2026-06-05

A security vulnerability has been identified in the X.Org X server and Xwayland, which are fundamental components used to manage graphical displays and user input on Linux systems. An attacker with local access to the system can exploit this flaw to crash the display server or potentially gain elevated administrative privileges. This could lead to a complete system takeover or a denial of service for all users on the affected machine.

Technologies: [X.Org Foundation X.Org Server](https://junglewise.ai/threats/technologies/x-server), [X.Org Foundation Xwayland](https://junglewise.ai/threats/technologies/xwayland). Vendors: [X.Org Foundation](https://junglewise.ai/threats/vendors/x-org-foundation).

## Quick answers

**Is CVE-2026-50261 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50261 being exploited in the wild.

**How severe is CVE-2026-50261?** High severity, with a CVSS score of 7.8, published 5 June 2026.

**Which products and versions are affected?** X.Org Foundation X.Org Server <= 21.1.22; X.Org Foundation Xwayland <= 24.1.9.

**Is there a fix for CVE-2026-50261?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50261 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-50261?** Check whether you run X.Org Foundation X.Org Server or X.Org Foundation Xwayland at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the X.Org X server and Xwayland within the SyncChangeCounter() function. The root cause is a failure to properly handle trigger list iteration when a trigger fires; specifically, the TriggerFired call can invoke FreeResource/FreeAwait, which unlinks and frees trigger list nodes, potentially including the next node in the current iteration. An attacker can exploit this by setting up multiple SyncCounters and using a second client connection to destroy them while they are being modified. This can result in a server crash or local privilege escalation if the X server is running with root privileges. The issue is fixed in xorg-server 21.1.23 and xwayland 24.1.12 by restarting the list iteration from the head after a trigger fires.

## Affected products

- X.Org xorg-x11-server <= 21.1.22
- X.Org xorg-x11-server-Xwayland <= 24.1.9

## Timeline

- 2026-04-20: other: Fix authored upstream
- 2026-06-02: advisory: X.Org security advisory released
- 2026-06-05: disclosed: CVE published and NVD record created

## References

- [https://access.redhat.com/security/cve/CVE-2026-50261](https://access.redhat.com/security/cve/CVE-2026-50261)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2485386](https://bugzilla.redhat.com/show_bug.cgi?id=2485386)
- [https://gitlab.freedesktop.org/xorg/xserver/-/commit/bdd7bf57af208b1ddf57d4683d67104443b44812](https://gitlab.freedesktop.org/xorg/xserver/-/commit/bdd7bf57af208b1ddf57d4683d67104443b44812)
- [https://lists.x.org/archives/xorg-announce/2026-June/003702.html](https://lists.x.org/archives/xorg-announce/2026-June/003702.html)
- [https://redhat.atlassian.net/browse/PSIRTSUPT-16950](https://redhat.atlassian.net/browse/PSIRTSUPT-16950)

## Related threats

- [X.Org X server and Xwayland use-after-free in FreeCounter](https://junglewise.ai/threats/cve-2026-50260-x-org-x-server-and-xwayland-use-after-free-in-freecounter)
- [X.Org X server stack buffer overflow in XKB SetMap request](https://junglewise.ai/threats/cve-2026-50259-x-org-x-server-stack-buffer-overflow-in-xkb-setmap-request)
- [X.Org X server out-of-bounds memory access in XKB request validation](https://junglewise.ai/threats/cve-2026-34003-x-org-x-server-out-of-bounds-memory-access-in-xkb-request)
- [X.Org X server use-after-free in miSyncTriggerFence](https://junglewise.ai/threats/cve-2026-34001-x-org-x-server-use-after-free-in-misynctriggerfence)
- [X.Org X server use-after-free in Xkb client resource removal](https://junglewise.ai/threats/cve-2025-62230-x-org-x-server-use-after-free-in-xkb-client-resource-removal)