CVE-2025-26601: Xorg: xwayland: use-after-free in syncinittrigger()
A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.
Other sources
When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object. This can be used to cause a use after free when the alarm eventually triggers.
— Red Hat
Xorg: xwayland: use-after-free in syncinittrigger()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:1.20.11-1+deb11u15Fixed in 2:21.1.7-3+deb12u9Fixed in 2:21.1.16-1 - Upgrade
Upgrade
debian/xwaylandto a version that resolves this vulnerability.Fixed in 2:24.1.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.1.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.10-15
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26601?
CVE-2025-26601 is rated as high severity due to the potential for exploitation of the use-after-free flaw.
How do I fix CVE-2025-26601?
To address CVE-2025-26601, update the xorg-server and xwayland packages to the latest versions provided in your distribution.
What software is affected by CVE-2025-26601?
CVE-2025-26601 affects the xorg-server and xwayland packages on Debian systems.
Can CVE-2025-26601 lead to arbitrary code execution?
Yes, the use-after-free flaw in CVE-2025-26601 could potentially allow an attacker to execute arbitrary code.
Is there a temporary workaround for CVE-2025-26601?
Currently, no specific temporary workaround for CVE-2025-26601 is recommended besides applying the software updates promptly.