CVE-2026-50261

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Red Hat rates this issue as Important impact. In xorg-x11-server and xorg-x11-server-Xwayland, a local X client can trigger a use-after-free in SyncChangeCounter() by creating SyncCounters on one connection while changing and destroying them from a second connection. Any local user who can connect to the X server display can attempt exploitation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.