CVE-2026-50257: Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()
A client that sets up multiple fence triggers can trigger a use-after-free function pointer call in miSyncDestroyFence(). An attacker connects to the X server to set up a fence and awaits that fence, then a second X connection destroys the fence, causing the use-after-free.
Any X client that can connect to the server can trigger this issue. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Components affected: xorg-x11-server, xorg-x11-server-Xwayland Versions affected: xorg-x11-server <= 21.1.22, xorg-x11-server-Xwayland <= 24.1.9
Fixed upstream in xorg-server-21.1.23 and xwayland-24.1.12. Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b
Reported via ZDI-CAN-30159 (Trend Micro Zero Day Initiative). Tracking: PSIRTSUPT-16950.
Other sources
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.
— NVD
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.1.12-1 - Upgrade
Upgrade
xorg-x11-serverto a version that resolves this vulnerability.Fixed in 21.1.23 - Upgrade
Upgrade
xorg-x11-server-Xwaylandto a version that resolves this vulnerability.Fixed in 24.1.12 - Compensating control
Since any X client that can connect to the server can trigger this issue, restrict X server access so only trusted clients can connect (e.g., limit network/IPC access to the X server).
- Operational
After upgrading to the fixed versions, restart the X server/Xwayland to ensure the new miSyncDestroyFence() code is loaded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50257?
The severity of CVE-2026-50257 is high with a rating of 7.8.
How do I fix CVE-2026-50257?
To fix CVE-2026-50257, update the X.Org X server and Xwayland to the latest patched versions provided by your distribution.
What are the consequences of CVE-2026-50257?
CVE-2026-50257 can lead to a use-after-free vulnerability which may allow attackers to execute arbitrary code on the affected system.
Who is affected by CVE-2026-50257?
Users running X.Org X server and Xwayland are affected by CVE-2026-50257.
What is the attack vector for CVE-2026-50257?
The attack vector for CVE-2026-50257 requires an attacker to connect to the X server and trigger multiple fence actions.