CVE-2026-88812: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-88812 is a double-free vulnerability in the X.Org X Server and XWayland affecting the X Keyboard Extension (XKB) geometry processing. The flaw exists in the _CheckSetDoodad() function in xkb/xkb.c, where a freed memory pointer is not nulled after an allocation failure, leading to a double-free during cleanup. It affects X.Org X Server (fixed in version 21.1.25) and XWayland (fixed in version 24.1.14). The CVE was published on October 7, 2026, and is rated High severity (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1341 (Multiple Releases of Same Resource or Handle), with a secondary estimate of CWE-416 (Use After Free). In _CheckSetDoodad(), a doodad is first added to the geometry via XkbAddGeomDoodad(), then doodad->text.text is allocated via _GetCountedString(). If the subsequent allocation of doodad->text.font fails — for example, because the font string length extends past the request boundary — the error handler frees doodad->text.text but does not NULL the pointer. When XkbFreeGeometry() later runs cleanup, _XkbClearDoodad() frees the same dangling pointer a second time, causing heap corruption. Exploitation requires a local authenticated user to send a specially crafted XKB SetGeometry request to the display server. The vulnerability was discovered by an anonymous researcher working with Trend Micro's Zero Day Initiative (ZDI-CAN-31221) (Red Hat Bugzilla).

Successful exploitation can result in heap memory corruption, potentially leading to a Denial of Service (DoS) via crash of the X server or XWayland, or arbitrary code execution with the elevated privileges of the display server process. Because the X server often runs with elevated privileges, code execution could allow a local attacker to escalate privileges on the affected system. The impact is limited to systems where an attacker already has local authenticated access and can connect to the X server (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The vulnerability requires local authenticated access to the X server, limiting the attack surface compared to remote vulnerabilities. The CVE status remains "Reserved" and no EPSS score or CISA KEV catalog entry has been identified. Detection plugins have been released by Nessus (IDs: 364284, 364336, 365480, 365547, 365552, 365612) and Qualys (ID: 6600923) (Feedly).

1. Reconnaissance: Identify a target system running a vulnerable version of X.Org X Server (prior to 21.1.25) or XWayland (prior to 24.1.14) with local user access.
2. Gain local access: Obtain a local authenticated session on the target system (e.g., via SSH, physical access, or an existing low-privilege shell).
3. Craft malicious XKB request: Construct a specially crafted XKB SetGeometry request that triggers the allocation of doodad->text.text via _GetCountedString(), followed by a font string whose length extends past the request boundary to cause the doodad->text.font allocation to fail.
4. Trigger double-free: Send the crafted request to the X display server. The error handler frees doodad->text.text without NULLing the pointer; subsequent cleanup by XkbFreeGeometry() → _XkbClearDoodad() frees the same pointer again, corrupting the heap.
5. Achieve objective: Leverage the heap corruption to cause a DoS (X server crash) or, with additional heap-shaping techniques, achieve arbitrary code execution with the privileges of the X server process (Red Hat Bugzilla).

• Logs: Unexpected X server crash logs or core dumps referencing xkb/xkb.c, _CheckSetDoodad(), or _XkbClearDoodad(); heap corruption error messages in system logs (/var/log/Xorg.0.log or journalctl).
• Process: Abnormal termination or restart of the Xorg or Xwayland process; unexpected child processes spawned by the X server.
• File System: Presence of core dump files (e.g., core.*) in the X server working directory following a crash.
• Network: Unusual local socket activity on the X display socket (e.g., /tmp/.X11-unix/X0) from unexpected processes or users.

Upgrade to X.Org X Server version 21.1.25 or later, and XWayland version 24.1.14 or later, which address this vulnerability (Gaming on Linux). Red Hat Enterprise Linux 9 users should apply RHSA-2026:82015 (Red Hat Errata). SUSE users should apply SUSE-SU-2026:4636-1, SUSE-SU-2026:4645-1, or SUSE-SU-2026:4663-1 as applicable (SUSE Advisory). As a workaround, restrict access to X server connections to trusted local users only, and consider running XWayland in isolated containerized or virtualized environments where patching is not immediately possible.

The vulnerability was part of a batch of twelve CVEs patched simultaneously in X.Org Server 21.1.25 and XWayland 24.1.14, which received coverage from Linux-focused outlets (Gaming on Linux, Linux Compatible). OpenBSD and FreeBSD also issued advisories addressing the vulnerability (OpenBSD Errata, FreeBSD VuXML). Community reaction has been measured, consistent with a local-only vulnerability with no public exploit code available.