CVE-2025-49178 is an improper locking vulnerability in the X.Org xwayland server's request handling mechanism. When a client's request specifies a non-zero 'bytes to ignore' value, the server may skip processing requests from other clients, leading to a denial of service condition. This flaw affects the xwayland component used to run X clients under Wayland. The vulnerability has been assigned a CVSS v3.1 base score of 5.5, indicating a medium severity with local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. Red Hat has released security updates addressing this issue in their xorg-x11-server-Xwayland packages for RHEL 8.4 and 9.4 Extended Update Support versions. The advisories provide updated package versions that fix the vulnerability.

The vulnerability allows a local attacker with low privileges to cause a denial of service by exploiting improper request handling in xwayland. There is no impact on confidentiality or integrity, but the availability of the X.Org xwayland server can be disrupted, potentially affecting graphical session stability for users relying on X clients under Wayland.

Red Hat has released official security updates for xorg-x11-server-Xwayland packages that address CVE-2025-49178. Users of affected Red Hat Enterprise Linux 8.4 and 9.4 Extended Update Support releases should apply these updates promptly to remediate the vulnerability. Refer to Red Hat advisory RHSA-2025:10258 and RHSA-2025:10342 and the update instructions at https://access.redhat.com/articles/11258 for detailed patching guidance. No additional mitigations are required beyond applying the vendor-provided patches.