DEBIAN-CVE-2026-93516: Use After Free

Q: Who can exploit this issue?

An authenticated X client can exploit the flaw. The attack requires local access and low privileges; no user interaction is required.

Q: What impact can exploitation have?

An attacker may crash the X server, causing a denial of service. The use-after-free may also potentially allow code execution in the X server context.

Q: Which component versions are affected?

The issue affects X.org X Server versions before 21.1.25 and XWayland versions before 24.1.14.

Published Oct 28, 2026

Updated

A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.

Affected Software

6 affected componentsFixes available

debian/xorg-server*

debian/xorg-server<2:21.1.25-1

2:21.1.25-1

debian/xwayland*

debian/xwayland<2:24.1.14-1

2:24.1.14-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/xorg-server to a version that resolves this vulnerability.
Fixed in 2:21.1.25-1
Upgrade
Upgrade debian/xwayland to a version that resolves this vulnerability.
Fixed in 2:24.1.14-1
Upgrade
Upgrade X.org X Server to a version that resolves this vulnerability.
Fixed in 21.1.25
Upgrade
Upgrade XWayland to a version that resolves this vulnerability.
Fixed in 24.1.14

Event History

Oct 28, 2026

CVE Published

via OSV·01:17 PM

Data Sourced

via OSV·01:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An authenticated X client can exploit the flaw. The attack requires local access and low privileges; no user interaction is required.

What impact can exploitation have?

An attacker may crash the X server, causing a denial of service. The use-after-free may also potentially allow code execution in the X server context.

Which component versions are affected?

The issue affects X.org X Server versions before 21.1.25 and XWayland versions before 24.1.14.

DEBIAN-CVE-2026-93516: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can exploitation have?

Which component versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can exploitation have?

Which component versions are affected?