A use‑after‑free flaw exists in the X.Org X server and Xwayland within miSyncDestroyFence(). By configuring multiple fence triggers, an attacker can cause the server to invoke a freed function pointer, which may crash the server or even execute code if the X server runs with elevated privileges.

Red Hat Enterprise Linux 10, 6, 7, 8, and 9 are impacted; any installation of the bundled Xorg X server package on these distributions should be considered vulnerable until a patch is applied.

The CVSS score of 7.8 indicates high severity. No EPSS score is available, so the precise likelihood of exploitation remains uncertain, but the vulnerability can be triggered remotely via an X client, enabling denial of service or potential privilege escalation when the X server runs as root. The flaw is not listed in CISA’s KEV catalog, suggesting no confirmed large‑scale exploitation yet. Administrators should treat the risk as significant and prepare to mitigate it promptly.