Use After Free in X.org X Server
CVE-2026-50257
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Vulnerability class: Use-After-Free
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (9.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 9th percentile — 9.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.002 · change: +0.001
Affected products
- X.org X Server
- X.org Xwayland
- Red Hat Enterprise Linux 10 — versions 0:24.1.9-4.el10_2.2
- Red Hat Enterprise Linux 10.0 Extended Update Support — versions 0:24.1.5-6.el10_0.1
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 6 Extended Lifecycle Support - Extension — versions 0:1.1.0-25.el6_10.18
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 7 Extended Lifecycle Support — versions 0:1.8.0-36.el7_9.5, 0:1.20.4-35.el7_9
- Red Hat Enterprise Linux 8 — versions 0:21.1.3-20.el8_10.2, 0:1.20.11-28.el8_10.2, 0:1.15.0-10.el8_10
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — versions 0:1.11.0-8.el8_4.16, 0:1.20.10-5.el8_4
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-50257 (Third Party Advisory, vdb-entry)
- RHBZ#2485382 (issue-tracking, Third Party Advisory, Issue Tracking)
- gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c4… (Patch)
- lists.x.org/archives/xorg-announce/2026-June/003702.html (Mailing List, Third Party Advisory)
- redhat.atlassian.net/browse/PSIRTSUPT-16950 (Permissions Required)
- RHSA-2026:26562 (vendor-advisory)
- RHSA-2026:26590 (vendor-advisory)
- RHSA-2026:26610 (vendor-advisory)
- RHSA-2026:26709 (vendor-advisory)
- RHSA-2026:26566 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-50257?
- CVE-2026-50257 is a high-severity vulnerability in X.org X Server, classified under Use After Free. CVSS score: 7.8/10. Published 2026-06-05.
- How severe is CVE-2026-50257?
- High severity. CVSS v3 base score is 7.8 out of 10.