This vulnerability involves a use-after-free condition in the FreeCounter() function of the X.Org X server and Xwayland. A client that creates multiple SyncCounters and waits on their triggers can cause a use-after-free when these counters are destroyed via a second client connection. This flaw can lead to a denial of service (server crash) or privilege escalation if the X server runs with root privileges. The issue affects Red Hat Enterprise Linux versions 8 (>=8 <8.10) and 10 (>=10 <10.2). Red Hat has issued security advisories RHSA-2026:26562 and RHSA-2026:26566 providing patches that fix this and other related vulnerabilities in the xorg-x11-server and Xwayland components.

Successful exploitation can cause the X server to crash, resulting in denial of service. More critically, if the X server is running with root privileges, the vulnerability may allow an attacker to escalate privileges. The CVSS 3.1 base score is 7.8 (high severity), reflecting the potential for high impact on confidentiality, integrity, and availability.

Red Hat has released official patches for this vulnerability in the xorg-x11-server and xorg-x11-server-Xwayland packages. Users should apply the updates provided in Red Hat Enterprise Linux 8.10 and 10.2 or later to remediate the issue. The advisories RHSA-2026:26562 and RHSA-2026:26566 contain detailed instructions and updated package versions. No additional mitigation steps are required beyond applying these official fixes.