CVE-2026-50257
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A use-after-free vulnerability was found in the X.Org X server and Xwayland in the miSyncDestroyFence() function. A client setting up multiple fence triggers can trigger a use-after-free function pointer call. An attacker connects to the X server to set up a fence and await it, then a second X connection destroys the fence, causing the use-after-free.
Risk Assessment
This vulnerability may lead to a crash of the X server or privilege escalation if the X server runs as root. It poses a serious risk to system stability and security.
Recommendation
It is recommended to immediately update the X.Org X server and Xwayland to the latest patched version. Additionally, restrict access to the X server to trusted users only.
Original NVD description (English source)
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.