Loading vulnerability…
Use-after-free in X.Org and Xwayland SyncChangeCounter()
CVE-2026-50261 is a use-after-free vulnerability in the XSYNC extension of the X.Org X server and Xwayland. SyncChangeCounter() caches the next trigger-list node before invoking a trigger callback. The callback can initiate resource teardown that frees sibling nodes, including the cached node, which the iteration subsequently dereferences. A client can trigger the flaw by changing multiple SyncCounters while destroying them through a second client connection. Exploitation can crash the server or potentially execute arbitrary code and escalate privileges when the X server runs as root.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause an X server denial of service through a crash. It can also potentially permit arbitrary code execution and root privilege escalation when the X.Org X server runs as root.
If you can’t patch tonight, do this now.
No workaround is identified; Red Hat confirmed that no workaround exists. Install the applicable security update rather than relying on a temporary mitigation.
Patch, then assume compromise.
Upgrade to X.Org Server 21.1.23 or Xwayland 24.1.12 or later, or install distribution packages containing the backported fix. The fix checks whether the cached next trigger-list node remains valid after the callback and restarts iteration when necessary. For Debian stable (trixie), upgrade xorg-server packages to 2:21.1.16-1.3+deb13u3 or later. EulerOS installations should install the applicable xorg-x11-server security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.