CVE-2025-26601 is a use-after-free vulnerability in X.Org and Xwayland components of the xserver. The flaw occurs when changing an alarm's trigger values; if an error arises during the change mask evaluation, the function returns early without adding a new sync object, potentially causing a use-after-free when the alarm triggers. This vulnerability has a high severity with a CVSS score of 7.8. Red Hat has issued security updates addressing this and related vulnerabilities in xserver and xwayland.
CVE-2025-26600 is a use-after-free vulnerability in X.Org and Xwayland components of the xserver. The flaw occurs when a device is removed while still frozen, leaving queued events for the freed device. Replaying these events triggers the use-after-free condition. This vulnerability has a high severity with a CVSS score of 7.8, impacting confidentiality, integrity, and availability.
CVE-2025-26599 is a high-severity vulnerability in the X.Org xserver and Xwayland components involving an access of an uninitialized pointer. The flaw occurs when the function compCheckRedirect() fails to allocate a backing pixmap, causing compRedirectWindow() to return a BadAlloc error without properly validating the window tree. This results in partially initialized data and subsequent use of an uninitialized pointer, which can lead to serious impacts on confidentiality, integrity, and availability.
CVE-2025-26598 is an out-of-bounds write vulnerability in the X.Org and Xwayland components of the xserver. The flaw occurs in the GetBarrierDevice() function, which incorrectly returns the last element of a device list when no matching device ID is found, leading to potential out-of-bounds memory access. This vulnerability has a high severity with a CVSS score of 7.8, impacting confidentiality, integrity, and availability. A fix is available as detailed in the Red Hat advisory.
CVE-2025-26597 is a buffer overflow vulnerability in the X.Org xserver and Xwayland components. The flaw occurs when the function XkbChangeTypesOfKey() is called with a zero group value, causing the key symbols table to resize to zero while leaving key actions unchanged. Subsequent calls with a non-zero group value lead to a buffer overflow due to mismatched sizes between key symbols and key actions.
CVE-2025-26596 is a heap-based buffer overflow vulnerability in X.Org and Xwayland's xserver component. The flaw arises due to a mismatch in length computation between XkbSizeKeySyms() and XkbWriteKeySyms(), leading to an out-of-bounds write. This vulnerability has a high severity with a CVSS score of 7.8, impacting confidentiality, integrity, and availability. Red Hat has issued a security advisory with patches addressing this and related vulnerabilities in xwayland. The flaw affects specific versions of xserver, including version 0 and 22.0.0.
CVE-2025-26595 is a stack-based buffer overflow vulnerability in the X.Org xserver and Xwayland components. The flaw exists in the XkbVModMaskText() function, which allocates a fixed-size stack buffer and copies virtual modifier names without checking buffer bounds. This can lead to memory corruption. The vulnerability has a high severity with a CVSS score of 7.8. Red Hat has issued security advisories addressing this and related vulnerabilities with patches available for affected versions.
CVE-2025-26594 is a use-after-free vulnerability in the X.Org X server and Xwayland components. The flaw arises because the root cursor is stored as a global variable, and if a client frees the root cursor, the server retains a reference to freed memory, leading to use-after-free conditions. This vulnerability has a high severity rating with a CVSS score of 7.8. Red Hat has issued a security advisory with patches addressing this and related vulnerabilities in X.Org and Xwayland. The vulnerability affects specific versions of the xserver product and has not been reported exploited in the wild.