Loading vulnerability…
Use-after-free in X.Org and Xwayland FreeCounter()
CVE-2026-50260 is a use-after-free vulnerability in the XSYNC extension of X.Org X server versions before 21.1.23 and Xwayland versions before 24.1.12. FreeCounter() invokes a CounterDestroyed callback while iterating a trigger list. The callback can release the SyncAwaitUnion and associated trigger memory, which the iteration subsequently dereferences. An attacker can trigger the vulnerable cleanup by creating multiple SyncCounters and awaiting their triggers through one X client connection, then destroying the counters through a second connection. Exploitation can crash the display server and may permit arbitrary code execution, including root privilege escalation when the server runs as root.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can crash the X server and terminate connected graphical sessions. If an attacker can control the freed heap contents, arbitrary code execution in the X server process may be possible. A root-running X server exposes the system to potential local privilege escalation to root; an unprivileged server is primarily exposed to denial of service.
If you can’t patch tonight, do this now.
No workaround or temporary mitigation is documented. Patch or upgrade the affected X.Org X server and Xwayland packages.
Patch, then assume compromise.
Upgrade to X.Org Server 21.1.23 or Xwayland 24.1.12 or later, or install distribution packages containing the backported fix. Debian stable (trixie) users should upgrade xorg-server to 2:21.1.16-1.3+deb13u3 or later. The upstream fix changes trigger-list iteration and cleanup, updates the list head before callbacks, and clears or checks trigger pointers to prevent subsequent access to freed objects.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.