CVE-2026-93536

A flaw was found in the X.Org Server. When a window is removed during an active gesture, the server fails to clean up references to the destroyed window in its gesture tracking data. A local attacker can exploit this flaw to cause a use-after-free condition—where the system accesses memory after it has been released—potentially leading to unauthorized information disclosure or a denial of service (DoS).

This vulnerability is rated with a Low severity on Red Hat systems because triggering it requires local access to an active graphical session and the impact is confined to a minor memory read or potential session crash rather than arbitrary code execution. Standard server installations without a desktop environment do not run Xorg or Xwayland and are not exposed. In graphical workstation environments, the flaw can only be triggered under specific timing conditions when a window is closed while gesture input events are being processed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.