UBUNTU-CVE-2026-88812: Double Free

Published Oct 27, 2026

Updated

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

Affected Software

14 affected components

ubuntu/xorg-server*

ubuntu/xorg-server-hwe-16.04*

ubuntu/xorg-server*

ubuntu/xorg-server-hwe-18.04*

ubuntu/xorg-server*

ubuntu/xwayland*

ubuntu/xorg-server*

ubuntu/xwayland*

ubuntu/xorg-server*

ubuntu/xwayland*

ubuntu/xorg-server*

ubuntu/xwayland*

Event History

Oct 27, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attached client with local access and low privileges can trigger the double free. No user interaction is required.

What impact could successful exploitation have?

The issue can crash the X server and may allow code execution in the X server context, with high impact to confidentiality, integrity, and availability.

Which upstream versions contain the fix?

The issue affects X.Org X Server versions before 21.1.25 and Xwayland versions before 24.1.14.

UBUNTU-CVE-2026-88812: Double Free

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

Which upstream versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

Which upstream versions contain the fix?