CVE-2026-50260
Modified Modified - Updated After Analysis
Use-After-Free in X.Org X Server and Xwayland

Publication date: 2026-06-05

Last updated on: 2026-06-25

Assigner: Red Hat, Inc.

Description
A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-05
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-05
EPSS Evaluated
2026-06-24
NVD
CVE-2026-50260
EUVD
EUVD-2026-34816
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
redhat enterprise_linux 7.0
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0
redhat enterprise_linux 10.0
x.org x_server to 21.1.23 (exc)
x.org xwayland to 24.1.12 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability involves a use-after-free flaw in the Xorg X11 server's FreeCounter() function triggered by clients setting up multiple SyncCounters and destroying them via a second client connection.

Detection on a network or system would typically involve checking the version of the xorg-x11-server and xorg-x11-server-Xwayland packages to see if they are vulnerable (versions up to 21.1.22 for xorg-server and 24.1.9 for xwayland).

Since the vulnerability is triggered by specific client behavior, monitoring for crashes or unusual behavior in the X server logs could indicate exploitation attempts.

Suggested commands to check installed versions on a Linux system include:

  • rpm -q xorg-x11-server
  • rpm -q xorg-x11-server-Xwayland

Alternatively, for systems using dpkg:

  • dpkg -l | grep xorg-x11-server
  • dpkg -l | grep xorg-x11-server-Xwayland

Additionally, monitoring X server logs (e.g., /var/log/Xorg.0.log) for crashes or errors related to SyncCounters could help detect exploitation attempts.

Executive Summary

CVE-2026-50260 is a use-after-free vulnerability found in the X.Org X server and Xwayland, specifically in the FreeCounter() function.

This flaw occurs when a client sets up multiple SyncCounters and waits on those triggers, and then a second client connection destroys those counters, causing a use-after-free condition.

This means that memory that has already been freed is accessed again, which can lead to unpredictable behavior.

Impact Analysis

Exploitation of this vulnerability can cause the X server to crash, resulting in denial of service.

More seriously, if the X server is running with root privileges, an attacker could leverage this flaw to escalate their privileges on the system.

Mitigation Strategies

To mitigate this vulnerability, you should update the affected components to the fixed versions.

  • Upgrade xorg-x11-server to version 21.1.23 or later.
  • Upgrade xorg-x11-server-Xwayland to version 24.1.12 or later.

These updates address the use-after-free flaw in the FreeCounter() function and prevent potential crashes or privilege escalation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50260. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart