CVE-2026-88812
Description
A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges.
Statement
This vulnerability is rated as Important because an authenticated local user able to connect to the X server or Xwayland display can trigger memory corruption, potentially leading to arbitrary code execution or privilege escalation with the privileges of the running display server. In typical Red Hat Enterprise Linux workstation and desktop environments, the X server or Xwayland runs as part of the user session, limiting the blast radius, though legacy configurations or privileged Xorg deployments could allow full local privilege escalation. Environments running headless servers without active graphical sessions or X11 forwarding are not exposed to this issue.
Mitigation
On server systems where a graphical desktop interface is not required, exposure can be mitigated by disabling the graphical display manager or removing optional X11/Xwayland packages.
To disable the graphical interface and boot into text mode:
systemctl set-default multi-user.target
systemctl isolate multi-user.target
Alternatively, remove the affected packages if graphical sessions are not utilized:
dnf remove xorg-x11-server-Xorg xorg-x11-server-Xwayland
Caveats:
Removing these packages or switching system targets will disable graphical login, may remove GNOME and related desktop packages via package manager dependencies, and will break graphical desktop functionality. The server will remain fully accessible and usable via local console terminals and remote SSH sessions.
Warning: Executing these commands will immediately terminate all active graphical sessions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
