Xorg: xwayland: use-after-free in playreleasedevents()

Summary

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.

Timeline

1. Feb 25, 2025, 3:55 PM UTCCVE published
2. Feb 25, 2025, 4:16 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Jun 29, 2026, 8:37 PM UTCRecord last updated

Affected versions

• xserver

  fixed in 21.1.16; From 22.0.0 · fixed in 24.1.6

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• tigervnc

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server

  Version range not reported

• xorg-x11-server-Xwayland

  Version range not reported

References 17