Live › vulnerability › CVE-2026-93516
Go to dashboardX.org X Server and XWayland mishandle the lifetime of XInput master devices when they are added or removed, leaving a use-after-free. An authenticated X client can crash the X server or potentially execute code in the X server's context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Systems running an X.org X Server before 21.1.25 or XWayland before 24.1.14 where untrusted or multi-user local clients can connect to the X display. The attacker must already be an authenticated X client, so single-user desktops and machines with no untrusted X clients are at lower risk. Teams that only run headless or Wayland-only setups without XWayland can skip it.
No product ranges from the sources yet.
Xorg -version or X -version and compare against 21.1.25Xwayland -version and compare against 24.1.1421.1.25 or later24.1.14 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.
This page as .md · .json · in your agent: get_signal("CVE-2026-93516")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.