{"id":"CVE-2026-88812","kind":"vulnerability","aliases":["CVE-2026-88812"],"related":[],"title":"X.Org X Server: XKB double free lets a client run code","description":"A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.","summary":"A double free in the XKB SetGeometry handling of X.Org X Server and X Wayland lets a connected client crash the server or possibly run code in the server's context. The sources describe the flaw but do not give exploit details.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-desktop","self-hosted","x.org","xwayland"],"not_affected_if":["patched-version"],"how_to_check":"- `Xorg -version` or `X -version` to read the installed X.Org X Server version\n- `Xwayland -version` to read the installed X Wayland version\n- unknown for whether XKB SetGeometry is reachable on a given system","fix":"- Upgrade X.Org X Server to `21.1.25` or later\n- Upgrade X Wayland to `24.1.14` or later\n- unknown for interim mitigations","status":"open","published_at":"2026-10-27T18:17:38+00:00","first_seen_at":"2026-10-27T18:33:00+00:00","triaged_at":"2026-10-27T18:34:31+00:00","updated_at":"2026-10-27T18:34:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T18:34:31Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade X.Org X Server to `21.1.25` or later\n- Upgrade X Wayland to `24.1.14` or later\n- unknown for interim mitigations","reach":"local","title":"X.Org X Server: XKB double free lets a client run code","impact":"high","summary":"A double free in the XKB SetGeometry handling of X.Org X Server and X Wayland lets a connected client crash the server or possibly run code in the server's context. The sources describe the flaw but do not give exploit details.","category":"infrastructure","nicknames":[],"who_cares":["x.org","xwayland","linux-desktop","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attached client crashes the X server or may run code in its context","analyst_note":"Check the NVD entry and X.Org security advisory for whether an unprivileged local client can reach SetGeometry by default, and for any exploit details.","how_to_check":"- `Xorg -version` or `X -version` to read the installed X.Org X Server version\n- `Xwayland -version` to read the installed X Wayland version\n- unknown for whether XKB SetGeometry is reachable on a given system","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Systems running X.Org X Server before `21.1.25` or X Wayland before `24.1.14` where clients can connect to the server. The sources do not say which default configurations expose the XKB SetGeometry path, so the affected set beyond these versions is unknown. Systems on patched versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000617,"input_tokens":3295,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-88812':14A,17A '21.1.25':79C '24.1.14':84C 'attach':89C 'caus':92C 'client':9A,45B,90C 'code':11A,52B,97C 'connect':44B 'context':57B,102C 'could':85C 'crash':46B,94C 'cve':12A,15A 'describ':60B 'desktop':21B 'detail':68B 'doubl':5A,28B,70C 'exploit':67B 'flaw':62B 'free':6A,29B,71C 'give':66B 'handl':34B 'host':24B 'infrastructur':18B 'let':7A,42B 'linux':20B 'linux-desktop':19B 'possibl':50B 'potenti':96C 'run':10A,51B 'self':23B 'self-host':22B 'server':3A,38B,48B,55B,77C,101C 'setgeometri':33B 'setgeometryin':74C 'sourc':59B 'use':87C 'wayland':41B,82C 'x':2A,37B,40B,76C,81C,100C 'x.org':1A,25B,36B,75C 'xkb':4A,32B,73C 'xwayland':26B","nicknames":[],"mitigations":[],"who_affected":"Systems running X.Org X Server before `21.1.25` or X Wayland before `24.1.14` where clients can connect to the server. The sources do not say which default configurations expose the XKB SetGeometry path, so the affected set beyond these versions is unknown. Systems on patched versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88812","severity":null,"published_at":"2026-10-27T18:17:38+00:00","modified_at":"2026-10-27T18:17:38+00:00","first_seen_at":"2026-10-27T18:33:00+00:00","fetched_at":"2026-10-27T18:33:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}