Vulnerability · Published Jun 5, 2026 · Assigned by redhat

CVE-2026-50257Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

High 7.8

In plain English

A high-severity use-after-free in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.1%top 96.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	tigervnc	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-icons	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-icons	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-license	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-license	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-selinux	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-selinux	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-server	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-server	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-server-minimal	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-server-minimal	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	tigervnc-server-module	1.15.0-10.el8_10	ALSA-2026:28923
AlmaLinux:9	tigervnc-server-module	1.15.0-7.el9_8.2	ALSA-2026:29844
AlmaLinux:8	xorg-x11-server-Xdmx	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xdmx	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-Xephyr	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xephyr	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-Xnest	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xnest	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-Xorg	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xorg	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-Xvfb	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-Xvfb	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:10	xorg-x11-server-Xwayland	24.1.9-4.el10_2.2	ALSA-2026:26566
AlmaLinux:8	xorg-x11-server-Xwayland	21.1.3-20.el8_10.2	ALSA-2026:26562
AlmaLinux:9	xorg-x11-server-Xwayland	24.1.9-4.el9_8.2	ALSA-2026:26590
AlmaLinux:10	xorg-x11-server-Xwayland-devel	24.1.9-4.el10_2.2	ALSA-2026:26566
AlmaLinux:9	xorg-x11-server-Xwayland-devel	24.1.9-4.el9_8.2	ALSA-2026:26590
AlmaLinux:8	xorg-x11-server-common	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-common	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-devel	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-devel	1.20.11-34.el9_8.2	ALSA-2026:26610
AlmaLinux:8	xorg-x11-server-source	1.20.11-28.el8_10.2	ALSA-2026:26709
AlmaLinux:9	xorg-x11-server-source	1.20.11-34.el9_8.2	ALSA-2026:26610
Debian:12	xorg-server	2:21.1.7-3+deb12u13	DEBIAN-CVE-2026-50257
Debian:13	xorg-server	2:21.1.16-1.3+deb13u3	DEBIAN-CVE-2026-50257
Debian:14	xorg-server	2:21.1.23-1	DEBIAN-CVE-2026-50257
Debian:12	xwayland	no fix listed	DEBIAN-CVE-2026-50257
Debian:13	xwayland	no fix listed	DEBIAN-CVE-2026-50257
Debian:14	xwayland	2:24.1.12-1	DEBIAN-CVE-2026-50257
Rocky Linux:8	tigervnc	0:1.15.0-10.el8_10	RLSA-2026:28923
Rocky Linux:9	tigervnc	0:1.15.0-7.el9_8.2	RLSA-2026:29844
Rocky Linux:8	xorg-x11-server	0:1.20.11-28.el8_10.2	RLSA-2026:26709
Rocky Linux:9	xorg-x11-server	0:1.20.11-34.el9_8.2	RLSA-2026:26610
Rocky Linux:10	xorg-x11-server-Xwayland	0:24.1.9-4.el10_2.2	RLSA-2026:26566
Rocky Linux:8	xorg-x11-server-Xwayland	0:21.1.3-20.el8_10.2	RLSA-2026:26562
Rocky Linux:9	xorg-x11-server-Xwayland	0:24.1.9-4.el9_8.2	RLSA-2026:26590
Ubuntu:22.04:LTS	xorg-server	no fix listed	UBUNTU-CVE-2026-50257
Ubuntu:24.04:LTS	xorg-server	no fix listed	UBUNTU-CVE-2026-50257
Ubuntu:25.10	xorg-server	no fix listed	UBUNTU-CVE-2026-50257
Ubuntu:26.04:LTS	xorg-server	no fix listed	UBUNTU-CVE-2026-50257
Ubuntu:26.10	xorg-server	no fix listed	UBUNTU-CVE-2026-50257
Ubuntu:22.04:LTS	xwayland	no fix listed	UBUNTU-CVE-2026-50257
Ubuntu:24.04:LTS	xwayland	no fix listed	UBUNTU-CVE-2026-50257
Ubuntu:25.10	xwayland	no fix listed	UBUNTU-CVE-2026-50257
Ubuntu:26.04:LTS	xwayland	no fix listed	UBUNTU-CVE-2026-50257
Ubuntu:26.10	xwayland	no fix listed	UBUNTU-CVE-2026-50257

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2026:26562 vendor-advisory, x_refsource_REDHAT
RHSA-2026:26566 vendor-advisory, x_refsource_REDHAT
RHSA-2026:26590 vendor-advisory, x_refsource_REDHAT
RHSA-2026:26610 vendor-advisory, x_refsource_REDHAT
RHSA-2026:26709 vendor-advisory, x_refsource_REDHAT
RHSA-2026:28923 vendor-advisory, x_refsource_REDHAT
RHSA-2026:29844 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36083 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36085 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36086 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36087 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36632 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36633 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36634 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36768 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36791 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36792 vendor-advisory, x_refsource_REDHAT
RHSA-2026:36798 vendor-advisory, x_refsource_REDHAT
RHSA-2026:38502 vendor-advisory, x_refsource_REDHAT
RHSA-2026:38810 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46377 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46382 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46385 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46392 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46456 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46460 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46473 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49519 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-50257 vdb-entry, x_refsource_REDHAT
RHBZ#2485382 issue-tracking, x_refsource_REDHAT
https://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b
https://lists.x.org/archives/xorg-announce/2026-June/003702.html
https://redhat.atlassian.net/browse/PSIRTSUPT-16950
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50257.json x_sadp-csaf-vex