Medium severity5.5NVD Advisory· Published Oct 28, 2026
CVE-2026-93516
CVE-2026-93516
Description
A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.
Affected products
14- osv-coords12 versionspkg:rpm/almalinux/xorg-x11-server-Xdmxpkg:rpm/almalinux/xorg-x11-server-Xephyrpkg:rpm/almalinux/xorg-x11-server-Xnestpkg:rpm/almalinux/xorg-x11-server-Xorgpkg:rpm/almalinux/xorg-x11-server-Xvfbpkg:rpm/almalinux/xorg-x11-server-Xwaylandpkg:rpm/almalinux/xorg-x11-server-Xwayland-develpkg:rpm/almalinux/xorg-x11-server-commonpkg:rpm/almalinux/xorg-x11-server-develpkg:rpm/almalinux/xorg-x11-server-sourcepkg:rpm/opensuse/xorg-x11-server&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/xwayland&distro=openSUSE%20Tumbleweed
< 1.20.11-34.el9_8.5+ 11 more
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 24.1.9-4.el10_2.4
- (no CPE)range: < 24.1.9-4.el10_2.4
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 1.20.11-34.el9_8.5
- (no CPE)range: < 21.1.24-2.1
- (no CPE)range: < 24.1.13-2.1
Patches
Vulnerability mechanics
References
1News mentions
1- ZDI-26-761: X.Org Server XInput Passive Grab Use-After-Free Information Disclosure VulnerabilityZero Day Initiative · Oct 15, 2026