CVE-2026-88812

A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges.

This vulnerability is rated as Important because an authenticated local user able to connect to the X server or Xwayland display can trigger memory corruption, potentially leading to arbitrary code execution or privilege escalation with the privileges of the running display server. In typical Red Hat Enterprise Linux workstation and desktop environments, the X server or Xwayland runs as part of the user session, limiting the blast radius, though legacy configurations or privileged Xorg deployments could allow full local privilege escalation. Environments running headless servers without active graphical sessions or X11 forwarding are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

On server systems where a graphical desktop interface is not required, exposure can be mitigated by disabling the graphical display manager or removing optional X11/Xwayland packages.

To disable the graphical interface and boot into text mode:

systemctl set-default multi-user.target
systemctl isolate multi-user.target

Alternatively, remove the affected packages if graphical sessions are not utilized:

dnf remove xorg-x11-server-Xorg xorg-x11-server-Xwayland

Caveats: Removing these packages or switching system targets will disable graphical login, may remove GNOME and related desktop packages via package manager dependencies, and will break graphical desktop functionality. The server will remain fully accessible and usable via local console terminals and remote SSH sessions.

Warning: Executing these commands will immediately terminate all active graphical sessions.