CVE-2026-56000: 
NixOS vulnerability analysis and mitigation

CVE-2026-56000 is a heap use-after-free vulnerability in the GLX dispatch layer of X.Org X server and Xwayland, formally titled "GLX contextTags Use-After-Free in CommonMakeCurrent()." It affects xorg-server before version 21.1.24 and xwayland before version 24.1.13. The vulnerability was disclosed on July 8, 2026, via an X.Org Security Advisory, and was discovered by an anonymous researcher working with Trend Micro Zero Day Initiative (ZDI-CAN-30561). It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 9.0 (Critical) (OSS-Security, Github Advisory).

The root cause is a use-after-free (CWE-416) and expired pointer dereference (CWE-825) in CommonMakeCurrent() within the GLX dispatch layer. The function calls GlxLookupContextTag() to capture a direct pointer (oldTag) into the per-client cl->contextTags array; if a subsequent realloc() moves this buffer to a new memory location, oldTag becomes a dangling pointer. An attacker can deliberately trigger this realloc by first creating 16 GLX contexts with MakeCurrent(oldContextTag=0) to fill all tag slots, then issuing a 17th MakeCurrent with a non-zero oldContextTag — requiring only 34 X11 requests (17 CreateContext + 17 MakeCurrent) in total. The subsequent GlxFreeContextTag(oldTag) then writes zeros into freed heap memory at five fixed offsets (16, 24, 32, 36, and 40 bytes) within the stale slot. Exploitation requires a local X connection; distributions that backported upstream commit 4781f2a5a8c2c2b000374e2d87982a6701d5a6b3 to the 21.1.x branch are confirmed affected (OSS-Security, Red Hat Bugzilla).

Successful exploitation allows a local attacker with an X connection to corrupt heap memory, potentially leading to arbitrary code execution, privilege escalation, or X server crash. The CVSS v3.1 scoring reflects high impacts to confidentiality, integrity, and availability of the affected system. In practice, an attacker could leverage this to escalate privileges to those of the X server process (often root or a privileged display user), enabling full system compromise (OSS-Security, Github Advisory).

1. Gain local X connection access: Obtain a local user account on the target system with access to the X display (e.g., via SSH with X forwarding, a local shell, or a compromised unprivileged account).
2. Establish GLX context: Connect to the X server and initialize a GLX-capable connection using standard X11/GLX client libraries.
3. Fill contextTags array: Issue 16 CreateContext requests followed by 16 MakeCurrent(oldContextTag=0) calls to fill all available GLX context tag slots to capacity, forcing the internal cl->contextTags array to its maximum size.
4. Trigger realloc and capture dangling pointer: Issue a 17th CreateContext followed by a MakeCurrent with a non-zero oldContextTag. This causes GlxLookupContextTag() to return a pointer into the old buffer, then realloc() moves the buffer, leaving oldTag dangling.
5. Trigger use-after-free write: The GlxFreeContextTag(oldTag) call writes zeros into freed heap memory at fixed offsets, corrupting heap metadata or adjacent allocations.
6. Achieve code execution or privilege escalation: Craft heap layout (heap grooming) so that the freed memory is reallocated to a controlled object, enabling arbitrary write primitives and ultimately code execution as the X server process (OSS-Security, Red Hat Bugzilla).

• Logs: X server logs (/var/log/Xorg.0.log or journald) showing rapid repeated GLX CreateContext and MakeCurrent requests from a single client in quick succession; X server crash or segfault entries referencing GLX or CommonMakeCurrent.
• Process: Unexpected child processes spawned by the Xorg or Xwayland process (e.g., shells, network tools); X server process terminating abnormally with a signal (SIGSEGV, SIGABRT).
• Network: Unusual outbound connections from the X server process following a sequence of rapid GLX requests (indicative of post-exploitation activity).
• File System: Unexpected files written to /tmp or world-writable directories by the X server process; new SUID binaries or modified system files following X server process activity.

The X.Org project has released fixed versions: xorg-server 21.1.24 and xwayland 24.1.13. The upstream fix is available at commit 2779affbdb4354e894f490e56f962527d6125043 on the freedesktop.org GitLab repository. Red Hat has addressed this in RHSA-2026:38489 (RHEL 10) and RHSA-2026:38490 (RHEL 9); SUSE has issued SUSE-SU-2026:2787-1 and SUSE-SU-2026:2788-1; Amazon Linux 2023 addressed it in ALAS2023-2026-1944. As a workaround where patching is not immediately possible, restrict X server access to trusted users only and disable GLX if it is not required for your use case (OSS-Security, Red Hat Bugzilla).

The vulnerability was covered by Phoronix and Gaming on Linux, which reported on the release of xorg-server 21.1.24 and xwayland 24.1.13 as security fixes. The Zero Day Initiative published advisory ZDI-26-405 for this issue. Security news outlets including SecurityOnline.info and pro-linux.de covered the dual advisory (alongside CVE-2026-55999). Community discussion was noted on Bluesky and various Linux distribution security mailing lists (openSUSE, Fedora, Slackware, Yocto). Overall community sentiment treated this as a routine but important security update requiring prompt patching, with no reports of active exploitation driving urgency beyond standard patch cycles.