Loading vulnerability…
GLX contextTags Use-After-Free in X.Org CommonMakeCurrent()
CVE-2026-56000 is a heap use-after-free vulnerability in GLX context-tag handling in X.Org X server and Xwayland. CommonMakeCurrent() retains an oldTag pointer into the per-client contextTags array. A subsequent CommonMakeNewCurrent() call can cause GlxAllocContextTag() to reallocate that array, invalidating the retained pointer. GlxFreeContextTag(oldTag) then writes zeros into freed heap memory. A malicious X client can trigger this sequence by filling the initial context-tag slots and requesting another context switch. The flaw can cause server crashes and potentially code execution, including privilege escalation when the server runs with elevated privileges. Security fixes are included in X.Org Server 21.1.24 and Xwayland 24.1.13; affected 21.1.x installations depend on whether the vulnerable change was backported.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation corrupts the X server heap and can crash the server, disrupting connected graphical applications and sessions. Potential code execution would occur with the X server process's privileges, threatening confidentiality, integrity, and availability. A privileged X server can therefore expose local privilege escalation. The demonstrated trigger establishes a use-after-free; reliable arbitrary code execution is not established.
If you can’t patch tonight, do this now.
Until patched, restrict X server connections to trusted clients and prevent untrusted users or applications from obtaining X display access. Restrict X11 forwarding where it would expose an affected server to untrusted clients. Avoid running the X server with elevated privileges to reduce privilege-escalation impact; this does not eliminate the memory-corruption vulnerability.
Patch, then assume compromise.
Upgrade to X.Org Server 21.1.24 or later and Xwayland 24.1.13 or later, or install the distribution's equivalent security backport. For Debian 13 (trixie), upgrade xorg-server packages to 2:21.1.16-1.3+deb13u4 or later. The code-level fix frees the old context tag and clears its pointer before CommonMakeNewCurrent() can reallocate the contextTags array. For older 21.1.x packages, consult the distribution's vulnerability status because exposure depends on backported changes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.