CVE-2025-26596

A use-after-free vulnerability was found in X.Org and Xwayland. When changing an alarm, the change mask values are evaluated sequentially, and if an error occurs, SyncInitTrigger() returns early without adding the new sync object. This can lead to use-after-free when the alarm eventually triggers.

A use-after-free vulnerability was found in X.Org and Xwayland. When a device is removed while frozen, queued events remain after the device is freed. Replaying these events causes a use-after-free.

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

An out-of-bounds write flaw was found in X.Org and Xwayland. The GetBarrierDevice() function returns the last element of the list instead of NULL when no matching device ID is found, leading to out-of-bounds memory access.

A buffer overflow flaw was found in X.Org and Xwayland. Calling XkbChangeTypesOfKey() with a 0 group resizes the key symbols table to 0 but leaves key actions unchanged. A later call with a non-zero group value causes a buffer overflow because the key actions are of the wrong size.

A buffer overflow flaw was found in X.Org and Xwayland in the XkbVModMaskText() function. The function allocates a fixed-size stack buffer and copies virtual modifier names without bounds checking, potentially leading to overflow.

A use-after-free vulnerability was found in X.Org and Xwayland. The root cursor is stored as a global variable, and if a client frees it, the internal reference points to freed memory, causing a use-after-free.