CVE-2026-50261

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

View on CVE.org
Published Jun 5, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Analysis

AI-generated

Technical impact

This vulnerability is a use‑after‑free in the SyncChangeCounter function of the X.Org X server and Xwayland. A client that creates multiple SyncCounters can trigger the flaw when a second client deletes those counters while they are still being changed. The flaw can cause the X server to crash or, if the server is running with root privileges, can be used to elevate privileges of the malicious client. The primary impact is privilege escalation when the X server runs as root, and potential denial of service through a crash.

Affected Systems

Affected users are those running Red Hat Enterprise Linux 6 through 10, as these distributions ship the vulnerable X.Org X server and Xwayland. The flaw applies to all versions of these distributions that include the affected packages before the latest security update.

Risk and Exploitability

The CVSS score of 7.8 indicates a high‑severity flaw. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but the flaw can be triggered by any client that can open a connection to the X server or Xwayland. If exploited, an attacker could crash the server or gain root privileges on systems where the X server runs with elevated rights. The primary attack vector is through a forged X client session, either local or networked, that exercises the counter functionality.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

OpenCVE Recommended Actions

  • Apply the latest Red Hat security update that patches X.Org X server to eliminate the use‑after‑free flaw.
  • If an update cannot be applied immediately, run the X server under a non‑root user or restrict its privileges to reduce the risk of privilege escalation.
  • Limit client access to the X server by configuring access controls (e.g., xhost or X server configuration) so that only trusted users can connect.

Generated by OpenCVE AI on June 5, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4737-1 xorg-server security update
Debian DLA Debian DLA DLA-4738-1 xorg-server security update
Debian DSA Debian DSA DSA-6370-1 xorg-server security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:26562 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26566 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26590 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26610 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26709 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:28923 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:29844 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36083 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36085 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36086 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36087 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36632 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36633 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36634 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36768 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36791 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36792 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:36798 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:38502 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:38810 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46377 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46382 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46385 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46392 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46456 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46460 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:46473 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:49519 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-50261 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2485386 cve-icon cve-icon
https://gitlab.freedesktop.org/xorg/xserver/-/commit/bdd7bf57af208b1ddf57d4683d67104443b44812 cve-icon cve-icon cve-icon
https://lists.x.org/archives/xorg-announce/2026-June/003702.html cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-50261 cve-icon
https://redhat.atlassian.net/browse/PSIRTSUPT-16950 cve-icon cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50261.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-50261 cve-icon
History
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:6
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhel_els:6
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
Redhat rhel Tus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Eus Long Life
CPEs cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Vendors & Products Redhat rhel Aus
Redhat rhel Eus Long Life
References
Type Values Removed Values Added
First Time appeared Redhat rhel Els
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Redhat rhel Eus
References
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
Vendors & Products Redhat rhel E4s
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
References
Type Values Removed Values Added
First Time appeared X.org x Server
X.org xwayland
CPEs cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products X.org x Server
X.org xwayland
Type Values Removed Values Added
First Time appeared X.org
X.org xorg-server
Vendors & Products X.org
X.org xorg-server
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Description A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Title Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-416
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (19)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 4, 2026, 10:43 PM
Reserved
Jun 4, 2026, 2:55 PM

View source JSON

Updated
Aug 5, 2026, 12:15 PM

JSON

Status
Modified
Published
Jun 5, 2026, 12:16 PM
Modified
Nov 4, 2026, 11:17 PM

View source JSON

Severity
Important
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 11:17 AM

JSON