X.Org X Server and XWayland: Double free in XKB SetGeometry
Summary
A double free (CWE-415) in the XKB SetGeometry code of the X.Org X Server and XWayland allows a locally connected client to crash the display server or possibly execute code in the X server context. The attacker needs a valid local session that can reach the X or XWayland display, so the issue is not directly internet-exposed. Headless servers without graphical sessions or X11 forwarding are not affected in practice.
Affected
- X.Org X Server before 21.1.25
- XWayland before 24.1.14
- Linux distribution packages (for example xorg-x11-server, xwayland) built from these versions. Red Hat lists RHEL 9 and 10 Xwayland as affected.
Fixed in
- X.Org X Server 21.1.25 and later
- XWayland 24.1.14 and later
- Distribution-specific fixed package versions: Unknown. Check your vendor's advisory for the exact package builds.
Workaround
- On servers that do not need a graphical desktop, disable the graphical display manager or remove the optional X11/Xwayland packages.
- No other vendor-recommended workaround is known for systems that must keep X running. Patching is the practical remedy.
Exploitation
- Not known to be exploited in the wild.
- Not listed in the CISA KEV catalog.
- No public proof-of-concept exploit confirmed at this time.
- EPSS: 0.19 % (percentile 8).
Our recommendation
- Identify Linux hosts with X.Org X Server or XWayland, especially multi-user terminal servers, shared jump hosts with X11 forwarding and privileged Xorg setups.
- Install the vendor updates for xorg-x11-server and xwayland as soon as possible on shared or privileged hosts, and through the normal cycle on Linux workstations.
- Remove X11/Xwayland packages from headless servers where they are not required.
- Monitor vendor advisories for updated package builds.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-88812 access.redhat.com
- X.Org Security Advisories www.x.org
- Upstream fix commit 0d1b1b0b (GitLab) gitlab.freedesktop.org
- SUSE CVE record via Vulners vulners.com
- OpenCVE CVE-2026-88812 app.opencve.io
- OffSeq Radar: XWayland security update radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:05.
Original description (NVD)
A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.