CVE-2025-26598: redhat enterprise_linux Out-of-bounds Write

Vulnerability summary

CVE-2025-26598 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in redhat enterprise_linux. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.2% of scored vulnerabilities.

Timeline

1. 25-02-2025
   PublishedVulnerability first disclosed.
2. 29-06-2026
   Last modifiedVulnerability information updated.

Description

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.