CVE-2026-50257

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

View on CVE.org
Published Jun 5, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Analysis

AI-generated

Technical impact

A use‑after‑free flaw exists in the X.Org X server and Xwayland within miSyncDestroyFence(). By configuring multiple fence triggers, an attacker can cause the server to invoke a freed function pointer, which may crash the server or even execute code if the X server runs with elevated privileges.

Affected Systems

Red Hat Enterprise Linux 10, 6, 7, 8, and 9 are impacted; any installation of the bundled Xorg X server package on these distributions should be considered vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. No EPSS score is available, so the precise likelihood of exploitation remains uncertain, but the vulnerability can be triggered remotely via an X client, enabling denial of service or potential privilege escalation when the X server runs as root. The flaw is not listed in CISA’s KEV catalog, suggesting no confirmed large‑scale exploitation yet. Administrators should treat the risk as significant and prepare to mitigate it promptly.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

OpenCVE Recommended Actions

  • Apply the latest Red Hat security update that patches the xorg-x11-server package for your RHEL release.
  • If an update is not yet available, restrict remote connections to the X server by binding it to localhost or using firewall rules to allow only trusted hosts and thereby limit fence‑trigger exploitation attempts.
  • Monitor X server logs for abnormal fence or SyncFence activity and enforce that the X server does not run with root privileges, following best practices for minimizing privileged service exposure.

Generated by OpenCVE AI on June 5, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4737-1 xorg-server security update
Debian DLA Debian DLA DLA-4738-1 xorg-server security update
Debian DSA Debian DSA DSA-6370-1 xorg-server security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:26562 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26566 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26590 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26610 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26709 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:28923 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:29844 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36083 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36085 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36086 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36087 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36632 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36633 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36634 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36768 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36791 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36792 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36798 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:38502 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:38810 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46377 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46382 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46385 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46392 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46456 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46460 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46473 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:49519 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-50257 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2485382 cve-icon cve-icon
https://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b cve-icon cve-icon cve-icon
https://lists.x.org/archives/xorg-announce/2026-June/003702.html cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-50257 cve-icon
https://redhat.atlassian.net/browse/PSIRTSUPT-16950 cve-icon cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50257.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-50257 cve-icon
History
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:6
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhel_els:6
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel Tus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Eus Long Life
CPEs cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Vendors & Products Redhat rhel Aus
Redhat rhel Eus Long Life
References
Type Values Removed Values Added
First Time appeared Redhat rhel Els
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Redhat rhel Eus
References
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
Vendors & Products Redhat rhel E4s
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared X.org x Server
X.org xwayland
CPEs cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products X.org x Server
X.org xwayland
Type Values Removed Values Added
First Time appeared X.org
X.org xorg-server
Vendors & Products X.org
X.org xorg-server
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Description A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Title Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-416
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (19)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 4, 2026, 10:43 PM
Reserved
Jun 4, 2026, 2:55 PM

View source JSON

Updated
Aug 5, 2026, 12:15 PM

JSON

Status
Modified
Published
Jun 5, 2026, 12:16 PM
Modified
Nov 4, 2026, 11:17 PM

View source JSON

Severity
Important
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 11:17 AM

JSON