Log in Start free

Vulnerability · Published Oct 28, 2026 · Assigned by suse

CVE-2026-93516.Org Server XInput Passive Grab Use-After-Free

Medium 5.5

In plain English

A medium-severity use-after-free in xorg-x11-server from x.org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 91.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8xorg-x11-server-Xdmx1.20.11-28.el8_10.5ALSA-2026:89747
AlmaLinux:9xorg-x11-server-Xdmx1.20.11-34.el9_8.5ALSA-2026:84574
AlmaLinux:8xorg-x11-server-Xephyr1.20.11-28.el8_10.5ALSA-2026:89747
AlmaLinux:9xorg-x11-server-Xephyr1.20.11-34.el9_8.5ALSA-2026:84574
AlmaLinux:8xorg-x11-server-Xnest1.20.11-28.el8_10.5ALSA-2026:89747
AlmaLinux:9xorg-x11-server-Xnest1.20.11-34.el9_8.5ALSA-2026:84574
AlmaLinux:8xorg-x11-server-Xorg1.20.11-28.el8_10.5ALSA-2026:89747
AlmaLinux:9xorg-x11-server-Xorg1.20.11-34.el9_8.5ALSA-2026:84574
AlmaLinux:8xorg-x11-server-Xvfb1.20.11-28.el8_10.5ALSA-2026:89747
AlmaLinux:9xorg-x11-server-Xvfb1.20.11-34.el9_8.5ALSA-2026:84574
AlmaLinux:10xorg-x11-server-Xwayland24.1.9-4.el10_2.4ALSA-2026:85191
AlmaLinux:8xorg-x11-server-Xwayland21.1.3-20.el8_10.4ALSA-2026:86907
AlmaLinux:9xorg-x11-server-Xwayland24.1.9-4.el9_8.4ALSA-2026:85193
AlmaLinux:10xorg-x11-server-Xwayland-devel24.1.9-4.el10_2.4ALSA-2026:85191
AlmaLinux:9xorg-x11-server-Xwayland-devel24.1.9-4.el9_8.4ALSA-2026:85193
AlmaLinux:8xorg-x11-server-common1.20.11-28.el8_10.5ALSA-2026:89747
AlmaLinux:9xorg-x11-server-common1.20.11-34.el9_8.5ALSA-2026:84574
AlmaLinux:8xorg-x11-server-devel1.20.11-28.el8_10.5ALSA-2026:89747
AlmaLinux:9xorg-x11-server-devel1.20.11-34.el9_8.5ALSA-2026:84574
AlmaLinux:8xorg-x11-server-source1.20.11-28.el8_10.5ALSA-2026:89747
AlmaLinux:9xorg-x11-server-source1.20.11-34.el9_8.5ALSA-2026:84574
Alpine:v3.24xorg-server21.1.25-r0ALPINE-CVE-2026-93516
Alpine:v3.24xwayland24.1.14-r0ALPINE-CVE-2026-93516
Debian:12xorg-serverno fix listedDEBIAN-CVE-2026-93516
Debian:13xorg-serverno fix listedDEBIAN-CVE-2026-93516
Debian:14xorg-server2:21.1.25-1DEBIAN-CVE-2026-93516
Debian:12xwaylandno fix listedDEBIAN-CVE-2026-93516
Debian:13xwaylandno fix listedDEBIAN-CVE-2026-93516
Debian:14xwayland2:24.1.14-1DEBIAN-CVE-2026-93516
Rocky Linux:8xorg-x11-server0:1.20.11-28.el8_10.5RLSA-2026:89747
Rocky Linux:9xorg-x11-server0:1.20.11-34.el9_8.5RLSA-2026:84574
Rocky Linux:10xorg-x11-server-Xwayland0:24.1.9-4.el10_2.4RLSA-2026:85191
Rocky Linux:8xorg-x11-server-Xwayland0:21.1.3-20.el8_10.4RLSA-2026:86907
Rocky Linux:9xorg-x11-server-Xwayland0:24.1.9-4.el9_8.4RLSA-2026:85193
Ubuntu:22.04:LTSxorg-serverno fix listedUBUNTU-CVE-2026-93516
Ubuntu:24.04:LTSxorg-serverno fix listedUBUNTU-CVE-2026-93516
Ubuntu:26.04:LTSxorg-serverno fix listedUBUNTU-CVE-2026-93516
Ubuntu:26.10xorg-serverno fix listedUBUNTU-CVE-2026-93516
Ubuntu:22.04:LTSxwaylandno fix listedUBUNTU-CVE-2026-93516
Ubuntu:24.04:LTSxwaylandno fix listedUBUNTU-CVE-2026-93516
Ubuntu:26.04:LTSxwaylandno fix listedUBUNTU-CVE-2026-93516
Ubuntu:26.10xwaylandno fix listedUBUNTU-CVE-2026-93516

Affected products (as reported)

VendorProductVersions
x.org xorg-x11-server 0 – before 21.1.25
x.org xwayland 0 – before 24.1.14

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References