CVE-2025-62230: Xorg: xwayland: use-after-free in xkb client resource removal
A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.
Other sources
Use-after-free vulnerability in the Xkb client resource removal logic of the X.Org X server and Xwayland. When removing a client’s Xkb resources, the XkbInterest data is freed prematurely while the associated resource reference remains active. When the client terminates, the cleanup routine attempts to delete already freed memory, causing a use-after-free that may lead to crashes or memory corruption.
— Red Hat
Xorg: xwayland: use-after-free in xkb client resource removal
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62230?
CVE-2025-62230 has been assigned a high severity due to its potential to cause memory corruption or crashes.
How do I fix CVE-2025-62230?
To fix CVE-2025-62230, update your X.Org X server or Xwayland to the latest version that addresses this vulnerability.
What products are affected by CVE-2025-62230?
CVE-2025-62230 affects the X.Org X server and Xwayland.
What type of vulnerability is CVE-2025-62230?
CVE-2025-62230 is classified as a use-after-free vulnerability affecting the Xkb extension.
What could happen if I don't address CVE-2025-62230?
Failing to address CVE-2025-62230 may lead to memory corruption, application crashes, and potential exploitation by attackers.