Description
A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.
Metrics
CVSS 3.1 7.8/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| — | — | < 21.1.16; >= 22.0.0, < 24.1.6 |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — |
| Red Hat | Red Hat Enterprise Linux 6 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
References
- https://access.redhat.com/errata/RHSA-2025:2500Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2502Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2861Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2862Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2865Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2866Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2873Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2874Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2875Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2879Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:2880Third Party Advisory
- https://access.redhat.com/errata/RHSA-2025:3976
- https://access.redhat.com/errata/RHSA-2025:7163
- https://access.redhat.com/errata/RHSA-2025:7165
- https://access.redhat.com/errata/RHSA-2025:7458
- https://access.redhat.com/security/cve/CVE-2025-26601Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2345251Issue Tracking
- https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html
- https://security.netapp.com/advisory/ntap-20250516-0004/
Timeline
- Published
- Feb 25, 2025
- Last modified
- Nov 4, 2026
- NVD status
- Modified