CVE-2026-34001

A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.

Scoring

Severity

HIGH

CVSS base score

7.8

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.26%

CWE

CWE-825

Published

2026-04-23

Last modified

2026-07-15

Affected products

• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 10

Weakness type

• CWE-825

Related vulnerabilities

• CVE-2026-77220 — PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting
• CVE-2026-76891 — Expired Pointer Dereference in Wireshark
• CVE-2026-76890 — Expired Pointer Dereference in Wireshark
• CVE-2026-17523 — can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet
• CVE-2026-10671 — User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)
• CVE-2026-54778 — CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
• CVE-2026-58592 — Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration
• CVE-2026-12610 — Sssd: use-after-free crash in sssd' 'sssd_pam' process

Markdown version · Browse all CVEs