This vulnerability involves a use-after-free condition in the miSyncDestroyFence() function of the X.Org X server and Xwayland. A client can set up multiple fence triggers, and through a sequence of connections to the X server—one setting up and awaiting a fence, another destroying it—a use-after-free function pointer call can be triggered. This can cause the X server to crash or allow privilege escalation if the server runs with root privileges. The issue is tracked as CVE-2026-50257 and is part of a set of security fixes released by Red Hat for xorg-x11-server and Xwayland components. The vulnerability affects Red Hat Enterprise Linux versions 8 (>=8.0.0 <8.10.2) and 10 (>=10.0.0 <10.2.2).

Successful exploitation can lead to denial of service by crashing the X server or privilege escalation if the X server is running as root, potentially allowing an attacker to execute code with elevated privileges. The CVSS v3.1 score is 7.8 (High), reflecting the significant confidentiality, integrity, and availability impacts.

Red Hat has released official security updates that fix this vulnerability. Users should apply the updates to the xorg-x11-server and xorg-x11-server-Xwayland packages as provided in Red Hat Enterprise Linux 8.10.2 and 10.2.2 or later. Refer to Red Hat advisory RHSA-2026:26562 for RHEL 8 and RHSA-2026:26566 for RHEL 10 for detailed update instructions. Applying these patches mitigates the vulnerability.