Introduction
A single memory safety flaw in a core display server can disrupt graphical environments on a very large number of Linux desktops and servers. CVE-2025-62229, a use-after-free in X.Org X Server and Xwayland, shows how a subtle bug in a protocol extension can lead to privilege escalation or denial of service, for end users and enterprises alike.
The X.Org Foundation maintains the X.Org X Server, the de facto standard display server for Unix-like operating systems, and Xwayland, which lets X11 applications run on Wayland-based systems. Both are deployed on millions of devices worldwide and underpin the graphical environment in Linux and BSD distributions, so their reliability and security matter to the stability of the whole open-source desktop.
Technical information
CVE-2025-62229 is in the Present extension of the X.Org X Server and Xwayland. Present synchronizes pixmap presentation with the display refresh cycle so that window updates are smooth and tear-free. The bug is in present_create_notifies, the function that handles notifications when a client asks to present a pixmap (an off-screen image) to a window.
The flaw is in the error handling of notification creation. If an error is triggered after a notification has already been added to the internal notification list, the cleanup logic miscounts how many notifications were added and leaves a dangling pointer behind. When the server later destroys the notification structures, that dangling pointer produces a use-after-free. This can corrupt memory or crash the server, and it may let an attacker execute arbitrary code with the privileges of the X server process.
The vulnerability is classified as CWE-416 (use-after-free). It is present in X.Org X Server versions from 1.15 up to (but not including) 21.1.18 and in Xwayland up to (but not including) 24.1.8. The bug was introduced in Xorg 1.15, released in December 2013, and went undetected for more than a decade. Jan-Niklas Sohn, working with Trend Micro's Zero Day Initiative, discovered it, and it was disclosed in October 2025.
The advisories include no public code snippets, but mailing list discussions and security trackers document the root cause well. If an error occurs after a notification has been inserted into the notification list, the error path in present_create_notifies does not free the notification structures properly, and a pointer to freed memory remains that can later be dereferenced.
Affected systems and versions
CVE-2025-62229 affects:
- X.Org X Server versions from 1.15 up to (but not including) 21.1.18
- Xwayland versions up to (but not including) 24.1.8
Any configuration with the Present extension enabled is vulnerable, and local users with access to the X server can trigger the bug. The issue is fixed in xorg-server 21.1.19 and xwayland 24.1.9. Major Linux distributions, including Ubuntu, Debian, and SUSE, have released patched packages.
Vendor security history
The X.Org Foundation has a long record of security advisories, many of them for memory safety issues such as use-after-free bugs, buffer overflows, and privilege escalation flaws. The foundation maintains a public security advisory process and usually coordinates timely patch releases with the major Linux distributions. In recent years, multiple vulnerabilities have turned up in the Present extension and related protocol handling code. That code is legacy C with complex protocol extensions, which makes it hard to maintain safely. The response to CVE-2025-62229 was prompt, and patches were released in coordination with the public disclosure.
