CVE-2026-50257: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()
A client that sets up multiple fence triggers can trigger a use-after-free function pointer call in miSyncDestroyFence(). An attacker connects to the X server to set up a fence and awaits that fence, then a second X connection destroys the fence, causing the use-after-free. Any X client that can connect to the server can trigger this issue. This may be used to crash the server, or for privilege escalation if the X server runs as root. Components affected: xorg-x11-server, xorg-x11-server-Xwayland Versions affected: xorg-x11-server <= 21.1.22, xorg-x11-server-Xwayland <= 24.1.9 Fixed upstream in xorg-server-21.1.23 and xwayland-24.1.12. Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b Reported via ZDI-CAN-30159 (Trend Micro Zero Day Initiative). Tracking: PSIRTSUPT-16950.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50257?
The severity of CVE-2026-50257 is high with a rating of 7.8.
How do I fix CVE-2026-50257?
To fix CVE-2026-50257, update the X.Org X server and Xwayland to the latest patched versions provided by your distribution.
What are the consequences of CVE-2026-50257?
CVE-2026-50257 can lead to a use-after-free vulnerability which may allow attackers to execute arbitrary code on the affected system.
Who is affected by CVE-2026-50257?
Users running X.Org X server and Xwayland are affected by CVE-2026-50257.
What is the attack vector for CVE-2026-50257?
The attack vector for CVE-2026-50257 requires an attacker to connect to the X server and trigger multiple fence actions.