High
Xorg: xwayland: use-after-free in playreleasedevents()
Type: advisorySources: OSV
A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-26600
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 04:43 UTC · Revision 1
Source evidence
Xorg: xwayland: use-after-free in playreleasedevents()
core-osv · Original sourcePublished 25 Feb 2025, 15:55 UTC
A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
osv:CVE-2025-26600
Complete source record
{
"id": "8e677fe173c2c609d6d2ed0b0150ce371ce052e43da5758d5ea8d602471fdaca",
"url": "https://osv.dev/vulnerability/CVE-2025-26600",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Xorg: xwayland: use-after-free in playreleasedevents()",
"summary": "A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.",
"evidence": "osv:CVE-2025-26600",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-26600",
"aliases": [
"CVE-2025-26600"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.freedesktop.org/xorg/xserver",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b7f84e6d509c004a7abb514af75b94cb907d451b"
},
{
"fixed": "5b1d9da00f217d3b52bfd3cc862dff79a9433e63"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "21.1.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "22.0.0"
},
{
"fixed": "24.1.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"xwayland-24.1.5",
"xorg-server-21.1.15",
"xwayland-24.1.4",
"xorg-server-21.1.14",
"xwayland-24.1.3",
"xwayland-24.1.2",
"xwayland-24.1.1",
"xwayland-24.1.0",
"xwayland-24.0.99.902",
"xorg-server-21.1.13",
"xwayland-24.0.99.901",
"xorg-server-21.1.12",
"xorg-server-21.1.11",
"xorg-server-21.1.10",
"xorg-server-21.1.9",
"xorg-server-21.1.8",
"xorg-server-21.1.7",
"xorg-server-21.1.6",
"xorg-server-21.1.5",
"xorg-server-21.1.4",
"xorg-server-21.1.3",
"xorg-server-21.1.2",
"xorg-server-21.1.1",
"xorg-server-21.1.0",
"xorg-server-21.0.99.902",
"xorg-server-21.0.99.901",
"xorg-server-21.0.99.1",
"xorg-server-1.20.0",
"xorg-server-1.19.99.905",
"xorg-server-1.19.99.904",
"xorg-server-1.19.99.903",
"xorg-server-1.19.99.902",
"xorg-server-1.19.99.901",
"xorg-server-1.19.0",
"xorg-server-1.18.99.902",
"xorg-server-1.18.99.901",
"xorg-server-1.18.99.2",
"xorg-server-1.18.0",
"xorg-server-1.17.99.902",
"xorg-server-1.17.99.901",
"xorg-server-1.17.0",
"xorg-server-1.16.99.902",
"xorg-server-1.16.99.901",
"xorg-server-1.16.0",
"xorg-server-1.15.99.904",
"xorg-server-1.15.99.903",
"xorg-server-1.15.99.902",
"xorg-server-1.15.99.901",
"xorg-server-1.15.0",
"xorg-server-1.14.99.905",
"xorg-server-1.14.99.904",
"xorg-server-1.14.99.903",
"xorg-server-1.14.99.902",
"xorg-server-1.14.99.901",
"xorg-server-1.14.99.3",
"xorg-server-1.14.99.2",
"xorg-server-1.14.99.1",
"xorg-server-1.14.0",
"xorg-server-1.13.99.902",
"xorg-server-1.13.99.901",
"xorg-server-1.13.0",
"xorg-server-1.12.99.905",
"xorg-server-1.12.99.904",
"xorg-server-1.12.99.903",
"xorg-server-1.12.99.902",
"xorg-server-1.12.99.901",
"xorg-server-1.12.0",
"xorg-server-1.11.99.903",
"xorg-server-1.11.99.902",
"xorg-server-1.11.99.901",
"xorg-server-1.11.99.1",
"xorg-server-1.11.0",
"xorg-server-1.10.99.902",
"xorg-server-1.10.99.901",
"xorg-server-1.10.0",
"xorg-server-1.9.99.903",
"xorg-server-1.9.99.902",
"xorg-server-1.9.99.901",
"xorg-server-1.9.0",
"xorg-server-1.8.99.906",
"xorg-server-1.8.99.905",
"xorg-server-1.8.99.904",
"xorg-server-1.8.99.903",
"xorg-server-1.8.99.902",
"xorg-server-1.8.99.901",
"xorg-server-1.8.0",
"xorg-server-1.7.99.902",
"xorg-server-1.7.99.901",
"xorg-server-1.7.99.2",
"xorg-server-1.7.99.1",
"xorg-server-1.6.99.901",
"xorg-server-1.6.99.900",
"xorg-server-1.5.99.1",
"xorg-server-1.1.99.3",
"xorg-server-1_1_99_2",
"xorg-server-1_0_99_901",
"XORG-7_0_99_901",
"xorg-server-1_1_99_1",
"xorg-server-1_0_99_2",
"xorg-server-1_0_99_1",
"XORG-7_0",
"pre-xgldrop-merge",
"XORG-6_99_99_904",
"MODULAR_COPY",
"XORG-6_99_99_903",
"XORG-6_8_99_903",
"DRM-2_0_0",
"XORG-6_99_99_902",
"XORG-6_8_99_902",
"DRM-1_0_5",
"XORG-6_99_99_901",
"XORG-6_8_99_901",
"DRM-20051017",
"kdrive-initial-import",
"xorg-server-0_99_1",
"XORG-6_99_99_900",
"XORG-6_8_99_900",
"XORG-6_8_99_16",
"XORG-6_8_99_15",
"XORG-6_8_99_14",
"XORG-6_8_99_13",
"XORG-6_8_99_12",
"DRM-20050615",
"sco_port_update-base",
"XORG-6_8_99_11",
"XORG-6_8_99_10",
"XORG-6_8_99_9",
"XORG-6_8_99_8",
"XORG-6_8_99_7",
"XORG-6_8_99_6",
"XORG-6_8_99_5",
"XORG-6_8_99_4",
"XORG-6_8_99_3",
"XORG-6_8_99_2",
"XORG-6_8_99_1",
"lg3d-base",
"XORG-6_8_0",
"XORG-6_7_99_904",
"XORG-6_7_99_903",
"XORG-6_7_99_902",
"XORG-6_7_99_901",
"XORG-6_7_99_2",
"XORG-6_7_99_1",
"DRM-20040721",
"DRI-trunk-20040721",
"DRI-trunk-20040613",
"DRI-XFree86-4_3_99_12-merge",
"DRM-20040613",
"XACE-SELINUX-MERGE",
"xf86-4_4_99_1",
"xf86-4_4_0",
"xf86-4_3_99_903",
"xf86-4_3_99_903_special",
"add-Xi",
"xf86-012804-2330",
"xf86-4_3_99_902",
"xf86-4_3_99_901",
"dri-0-1-branchpoint",
"xf86-4_3_99_16",
"xf86-4_3_0_1",
"PRE_xf86-4_3_0_1",
"XORG-MAIN",
"xfixes_2_branchpoint",
"keithp",
"xf-4_3_99_6",
"xf-4_3_99_5",
"xf-4_3_99_4",
"xf-4_3_99_3",
"xf-4_3_99_2",
"xf-4_3_99_1",
"xf-4_3_0_1",
"xf-4_3_0",
"xf-4_2_99_902",
"xf-4_2_99_901",
"xf-4_2_99_4",
"xf-4_2_99_3",
"ah-20021030-postdri",
"xf-4_2_99_2",
"ah-20021030",
"dhd-20020916",
"xf-4_2_99_1",
"dri-20020222-merge",
"before-mesa-4_0-import",
"dri-20020129-merge",
"xf-4_2_1_1",
"xf-4_2_1",
"xf-4_2_0_1",
"xf-4_2_0-bindist-1",
"xf-4_2_0-bindist",
"xf-4_2_0",
"xf-4_2-bp",
"xf-4_1_99_7",
"xf-4_1_99_6",
"xf-4_1_99_5",
"xf-4_1_99_4",
"Domain-sync4",
"Domain-sync3",
"xf-4_1_99_3",
"xf-4_1_99_2",
"Domain-sync2",
"Domain-sync1",
"Domain-base",
"xf-4_1_99_1",
"dhd-20010817",
"xf-4_0_99_900",
"xf-4_0_99_3",
"xf-4_0_99_2",
"dhd-20010328",
"xf-4_0_99_1",
"xf-4_0_2-bindist",
"xf-4_0_2",
"xf-4_0_1Zc",
"xf-4_0_1Zb",
"pre-R651-import",
"xf-4_0_1Za",
"xf-4_0_1Z",
"xf-4_0_1h",
"xf-4_0_1g",
"xf-4_0_1f",
"xf-4_0_1e",
"xf-4_0_1d",
"xf-4_0_1c",
"xf-4_0_1b",
"xf-4_0g",
"xf-4_0f",
"xf-4_0e",
"xf-4_0d",
"xf-4_0c",
"xf-4_0_1a",
"xf-4_0_1-bindist",
"xf-4_0_1",
"xf-4_0Z",
"xf-4_0b",
"xf-4_0a",
"xf-4_0-bindist",
"xf-4_0",
"xf-3_9_18b",
"xf-3_9_18a",
"xf-3_9_18Za",
"xf-3_9_18Z",
"xf-3_9_18",
"xf-3_9_17f",
"xf-3_9_17e",
"xf-3_9_17d",
"xf-3_9_17c",
"xf-3_9_17b",
"xf-3_9_17a",
"xf-3_9_17Z",
"xf-3_9_17",
"xf-3_9_16Za",
"xf-3_9_16f",
"xf-3_9_16e",
"xf-3_9_16d",
"xf-3_9_16Z"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-26600.json"
}
}
],
"modified": "2026-10-28T02:30:46.803838918Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html",
"https://access.redhat.com/errata/RHSA-2025:2500",
"https://access.redhat.com/errata/RHSA-2025:2502",
"https://access.redhat.com/errata/RHSA-2025:2861",
"https://access.redhat.com/errata/RHSA-2025:2862",
"https://access.redhat.com/errata/RHSA-2025:2865",
"https://access.redhat.com/errata/RHSA-2025:2866",
"https://access.redhat.com/errata/RHSA-2025:2873",
"https://access.redhat.com/errata/RHSA-2025:2874",
"https://access.redhat.com/errata/RHSA-2025:2875",
"https://access.redhat.com/errata/RHSA-2025:2879",
"https://access.redhat.com/errata/RHSA-2025:2880",
"https://access.redhat.com/errata/RHSA-2025:3976",
"https://access.redhat.com/errata/RHSA-2025:7163",
"https://access.redhat.com/errata/RHSA-2025:7165",
"https://access.redhat.com/errata/RHSA-2025:7458",
"https://access.redhat.com/security/cve/CVE-2025-26600",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26600.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-26600",
"https://security.netapp.com/advisory/ntap-20250516-0005/",
"https://bugzilla.redhat.com/show_bug.cgi?id=2345252",
"https://gitlab.freedesktop.org/xorg/xserver/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-416"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "0:24.1.5-3.el10_0"
},
{
"fixed": "0:1.1.0-25.el6_10"
},
{
"fixed": "0:1.8.0-36.el7_9"
},
{
"fixed": "0:1.20.4-30.el7_9"
},
{
"fixed": "0:1.13.1-15.el8_10"
},
{
"fixed": "0:1.9.0-15.el8_2.13"
},
{
"fixed": "0:1.11.0-8.el8_4.12"
},
{
"fixed": "0:1.11.0-8.el8_4.12"
},
{
"fixed": "0:1.11.0-8.el8_4.12"
},
{
"fixed": "0:1.12.0-6.el8_6.13"
},
{
"fixed": "0:1.12.0-6.el8_6.13"
},
{
"fixed": "0:1.12.0-6.el8_6.13"
},
{
"fixed": "0:1.12.0-15.el8_8.12"
},
{
"fixed": "0:1.14.1-1.el9_5.1"
},
{
"fixed": "0:1.20.11-28.el9_6"
},
{
"fixed": "0:23.2.7-3.el9_6"
},
{
"fixed": "0:1.11.0-22.el9_0.13"
},
{
"fixed": "0:1.12.0-14.el9_2.10"
},
{
"fixed": "0:1.13.1-8.el9_4.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26600.json"
}
},
"related_cves": [
{
"value": "CVE-2025-26600",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 514631,
"published_at": "2025-02-25T15:55:20.421+00:00"
}