This vulnerability involves a use-after-free flaw in the SyncChangeCounter() function of the X.Org X server and Xwayland. A client setting up multiple SyncCounters can trigger the use-after-free condition by destroying counters via a second client connection while changing those counters. This flaw can cause the X server to crash or potentially allow privilege escalation when the server runs as root. The issue is part of a set of security fixes released by Red Hat for xorg-x11-server and Xwayland components, addressing multiple stack buffer overflows, out-of-bounds reads/writes, and use-after-free bugs. The vulnerability affects Red Hat Enterprise Linux 10 versions from 10.0.0 up to but not including 10.2.2.

Successful exploitation of this use-after-free vulnerability can result in denial of service by crashing the X server or privilege escalation if the X server is running with root privileges. The CVSS v3.1 base score is 7.8, indicating high severity with high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Red Hat has released official security updates that fix this vulnerability in xorg-x11-server and xorg-x11-server-Xwayland packages. Users should apply the update to versions 10.2.2 or later to remediate the issue. Detailed update instructions are available in the Red Hat advisory (RHSA-2026:26566) and related articles. No additional mitigation is required beyond applying the official patch.