Six privilege escalation vulnerabilities have been disclosed in the X.Org X server and Xwayland, the display server infrastructure present on virtually every Linux and Unix system with graphical capabilities. All six carry CVSS scores of 7.8 and enable local privilege escalation — potentially to root — through stack-based buffer overflows, use-after-free vulnerabilities, and out-of-bounds writes in core X server components.
What Are the Vulnerabilities?
The six vulnerabilities span multiple X server subsystems:
CVE-2026-50256 (CVSS 7.8, CWE-121 — Stack Buffer Overflow in Font Resolution): A mismatch between the X server and libXfont2 library’s maximum font name length causes a stack buffer overflow during font alias resolution. The server allocates a 256-byte stack buffer but libXfont2’s alias target name length is 1024 bytes, allowing an overflow via crafted font alias names.
CVE-2026-50257 (CVSS 7.8, CWE-416 — Use-After-Free in Fence Synchronisation): A use-after-free in miSyncDestroyFence(). A client that sets up multiple fence triggers can cause a use-after-free function pointer call by destroying the fence via a second X connection.
CVE-2026-50258 (CVSS 7.8, CWE-121 — Stack Buffer Overflow in Keyboard Map): The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types. A client can change key types to excessive shift levels and trigger stack overflows.
CVE-2026-50259 (CVSS 7.8, CWE-121 — Stack Buffer Overflow in Key Map Checks): _XkbSetMapChecks() declares a fixed-size stack buffer indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow.
CVE-2026-50260 and CVE-2026-50261 (CVSS 7.8, CWE-416 — Use-After-Free in Sync Counters): Two use-after-free vulnerabilities in FreeCounter() and SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger use-after-free conditions when destroying or changing those counters via a second client connection.
CVE-2026-50264 (CVSS 7.8, CWE-787 — Out-of-Bounds Write in DRI Buffers): An out-of-bounds heap write in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write.
All six vulnerabilities can be exploited by any local user who can connect to the X server. If the X server runs as root — which it does by default on many distributions — exploitation leads to root privilege escalation. On systems where the X server runs as a non-root user, exploitation can still crash the display server or escalate to the X server’s user privileges.
Which Versions Are Affected?
- X.Org X server — all versions prior to the patched release
- Xwayland — all versions prior to the patched release
Virtually every Linux and Unix system with a graphical interface is affected: developer workstations, engineering desktops, Linux servers running graphical applications, and any system running X11 or Xwayland.
Is It Being Exploited in the Wild?
No active exploitation has been publicly confirmed. However, local privilege escalation vulnerabilities in the X server are well-understood and exploit development for stack overflows and use-after-free vulnerabilities in C is straightforward for attackers with relevant skills. Multi-user Linux systems, shared workstations, and environments where untrusted users have local shell access should patch promptly.
What Are the Fixes?
Updates are available through Linux distribution package managers. Apply the X.Org server and Xwayland security updates via your distribution’s standard update mechanism. After updating, restart the X server or reboot the system. Verify the updated version is active.
Recommendations
Apply X.Org updates on all Linux systems with graphical capabilities. Prioritise multi-user systems, shared workstations, and any environment where unprivileged users have local shell access.
Consider running X as non-root where possible. Modern Linux distributions increasingly run the X server as a non-root user — verify your configuration aligns with this best practice. While exploitation is still possible, the impact is reduced from root to the X server’s user.
Restrict X server access. On multi-user servers, limit which users can connect to the X server. Use xauth for access control rather than xhost + which allows connections from any host.
References
- NVD: CVE-2026-50256
- NVD: CVE-2026-50257
- NVD: CVE-2026-50264
- Vulnerability Intelligence Report — June 6, 2026
This advisory was first covered in the broader Vulnerability Intelligence Report — June 6, 2026.
