{"id":"CVE-2026-93516","kind":"vulnerability","aliases":["CVE-2026-93516"],"related":[],"title":"X.org X Server: use-after-free when adding or removing XInput master devices","description":"A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.","summary":"X.org X Server and XWayland mishandle the lifetime of XInput master devices when they are added or removed, leaving a use-after-free. An authenticated X client can crash the X server or potentially execute code in the X server's context.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","infrastructure","linux","multi-user","xorg","xwayland"],"not_affected_if":["no-untrusted-x-clients","wayland-only-no-xwayland"],"how_to_check":"- Run `Xorg -version` or `X -version` and compare against `21.1.25`\n- Run `Xwayland -version` and compare against `24.1.14`\n- Check your distribution's package manager for the installed xorg-server or xwayland package version","fix":"- Upgrade X.org X Server to `21.1.25` or later\n- Upgrade XWayland to `24.1.14` or later\n- Apply your distribution's xorg-server and xwayland security updates","status":"open","published_at":"2026-10-28T13:17:29+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:26+00:00","updated_at":"2026-10-28T13:34:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T13:34:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade X.org X Server to `21.1.25` or later\n- Upgrade XWayland to `24.1.14` or later\n- Apply your distribution's xorg-server and xwayland security updates","reach":"local","title":"X.org X Server: use-after-free when adding or removing XInput master devices","impact":"high","summary":"X.org X Server and XWayland mishandle the lifetime of XInput master devices when they are added or removed, leaving a use-after-free. An authenticated X client can crash the X server or potentially execute code in the X server's context.","category":"infrastructure","nicknames":[],"who_cares":["linux","xorg","xwayland","desktop","multi-user"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker crashes the X server or may run code in its context","analyst_note":"Confirm from the X.org security advisory whether code execution is confirmed or only possible, and whether the flaw is reachable through XWayland by default.","how_to_check":"- Run `Xorg -version` or `X -version` and compare against `21.1.25`\n- Run `Xwayland -version` and compare against `24.1.14`\n- Check your distribution's package manager for the installed xorg-server or xwayland package version","needs_analyst":true,"not_affected_if":["wayland-only-no-xwayland","no-untrusted-x-clients"],"who_is_affected":"Systems running an X.org X Server before 21.1.25 or XWayland before 24.1.14 where untrusted or multi-user local clients can connect to the X display. The attacker must already be an authenticated X client, so single-user desktops and machines with no untrusted X clients are at lower risk. Teams that only run headless or Wayland-only setups without XWayland can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3304,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-93516':17A,20A '21.1.25':94C '24.1.14':98C 'add':9A,44B,84C 'authent':54B,103C 'caus':77C 'client':56B,105C 'code':65B,114C 'context':71B,118C 'could':99C 'crash':58B,107C 'cve':15A,18A 'desktop':21B 'devic':14A,40B,88C 'execut':64B,113C 'free':7A,52B,76C 'infrastructur':22B 'lack':79C 'leav':47B 'lifecycl':81C 'lifetim':36B 'linux':23B 'manag':82C 'master':13A,39B,87C 'mishandl':34B 'multi':25B 'multi-us':24B 'potenti':63B,112C 'remov':11A,46B,85C 'server':3A,31B,61B,69B,92C,110C,117C 'use':5A,50B,74C,101C 'use-after-fre':4A,49B,73C 'user':26B 'x':2A,30B,55B,60B,68B,91C,104C,109C,116C 'x.org':1A,29B,90C 'xinput':12A,38B,86C 'xorg':27B 'xwayland':28B,33B,96C","nicknames":[],"mitigations":[],"who_affected":"Systems running an X.org X Server before 21.1.25 or XWayland before 24.1.14 where untrusted or multi-user local clients can connect to the X display. The attacker must already be an authenticated X client, so single-user desktops and machines with no untrusted X clients are at lower risk. Teams that only run headless or Wayland-only setups without XWayland can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93516","severity":null,"published_at":"2026-10-28T13:17:29+00:00","modified_at":"2026-10-28T13:17:29+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}