Loading vulnerability…
Use-after-free in X.Org X server and Xwayland miSyncDestroyFence()
CVE-2026-50257 is a use-after-free vulnerability in the XSYNC extension of the X.Org X server and Xwayland, affecting miSyncDestroyFence(). During fence destruction, callbacks invoked while traversing a trigger list can free structures that subsequent iterations still reference, resulting in a use-after-free function-pointer call. An attacker can trigger the flaw by establishing multiple triggers for a fence through one X client connection and destroying that fence through a second connection. Exploitation can crash the display server or potentially escalate privileges when the X server runs as root. Affected upstream versions are xorg-server before 21.1.23 and Xwayland before 24.1.12.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash the X server and terminate active graphical sessions. If attacker-controlled data occupies the freed memory, exploitation may redirect execution through a controlled function pointer. A root-running X server exposes the system to potential root privilege escalation and full system compromise; an unprivileged server limits execution privileges to those of its process.
If you can’t patch tonight, do this now.
No temporary workaround is specified in the Debian advisory. Running the X server without root privileges limits the privilege-escalation impact to the server process's privileges, but does not prevent exploitation or display-server crashes. Installing the fixed packages remains necessary.
Patch, then assume compromise.
Upgrade to xorg-server 21.1.23 or Xwayland 24.1.12 or later, or install distribution packages containing the backported fix. For Debian stable (trixie), upgrade xorg-server to 2:21.1.16-1.3+deb13u3 or later. For Echo, update the affected xorg-server package to 2:21.1.16-1.3+deb13u2+e2 or later. The upstream fix introduces safe trigger-list traversal, advances the list head before destructive callbacks, checks for null trigger pointers, and clears matching trigger pointers during FreeAwait() cleanup.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.