CVE-2026-50257 Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

High 7.8 Published 5 Jun 2026 Updated 28 Sep 2026

A use-after-free in X.Org X server allows attackers to crash the server or escalate privileges via malicious fence triggers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-50257?

CVE-2026-50257 is a high-severity use after free vulnerability in Redhat Enterprise Linux, published on 5 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Weakness: CWE-416

Which versions are affected by CVE-2026-50257?

It affects 3 products.

Products include Redhat Enterprise Linux, X.org X Server, X.org Xwayland.

How do I fix CVE-2026-50257?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-50257 being exploited?

There is no known exploitation of CVE-2026-50257 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as AZL-89531, AZL-89583, BELL-CVE-2026-50257, DEBIAN-CVE-2026-50257, ECHO-0425-aeba-68ae, GHSA-5p7p-jgvj-4v95 and 1 more.