CVE-2025-26601: Red Hat Enterprise Linux

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.

Affected products

• Red Hat Enterprise Linux: version 7.0 only; version 8.0 only; version 9.0 only
• Tigervnc Tigervnc: affected versions not specified
• X.org X Server: before 21.1.16 (fixed in 21.1.16)
• X.org Xwayland: before 24.1.6 (fixed in 24.1.6)

Published 2025-02-25. Last modified 2026-06-29.