Use-After-Free Vulnerability in X.Org and Xwayland Products
CVE-2025-26600

7.8HIGH

Key Information:

Vendor
Red Hat
Status
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
25 February 2025

Summary

A use-after-free flaw has been identified in X.Org and Xwayland that occurs when a device is removed while still being frozen. In this scenario, events that are queued for the device persist despite the device being freed. If these events are subsequently replayed, it leads to unintended behavior and potential security risks. This issue necessitates prompt addressing to prevent exploitation.

References

https://access.redhat.com/security/cve/CVE-2025-26600
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2345252
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.