Use-After-Free Flaw in X.Org and Xwayland Affects Global Cursor Handling
CVE-2025-26594

7.8HIGH

Key Information:

Vendor
Red Hat
Status
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
25 February 2025

Summary

A use-after-free vulnerability exists in X.Org and Xwayland due to improper management of the root cursor as a global variable. When a client improperly frees the root cursor, it leads to references pointing to deallocated memory. This inconsistency could be exploited, potentially leading to unexpected behavior or security breaches. It is critical for users and administrators to audit their systems for this vulnerability to mitigate possible risks.

References

https://access.redhat.com/security/cve/CVE-2025-26594
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2345248
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.