Executive brief
A vulnerability exists in the X.Org X server and Xwayland, which are fundamental components used to manage graphical displays and windows on Linux and Unix-like systems. A local attacker or a user with an active X connection can trigger a memory error that could lead to a system crash or potentially allow them to execute unauthorized code. This could compromise the stability of the workstation or allow an attacker to gain higher privileges on the system.
Technical details
A heap use-after-free vulnerability exists in the CommonMakeCurrent() function within the GLX dispatch layer of xorg-server and xwayland. The function captures a direct pointer (oldTag) into the per-client cl->contextTags array. If a subsequent call to CommonMakeNewCurrent() triggers a realloc() of the contextTags array (which occurs when the initial 16-slot capacity is exceeded), the oldTag pointer becomes dangling. The subsequent call to GlxFreeContextTag(oldTag) then performs a write-what-where (zeroing five fields at fixed offsets) into freed heap memory. An attacker can trigger this by creating 17 GLX contexts and performing specific MakeCurrent requests. The issue is fixed in xorg-server 21.1.24 and xwayland 24.1.13.
Affected products
- X.Org xorg-server before 21.1.24
- X.Org xwayland before 24.1.13
Timeline
- 2026-05-31: patched: Fix authored in upstream repository
- 2026-07-08: advisory: X.Org Security Advisory released
- 2026-07-08: disclosed: Public disclosure on oss-security mailing list