Olivier Fourdan 116c128a7e dix: Dequeue pending events on frozen device on removal ...

When a device is removed while still frozen, the events queued for that
device remain while the device itself is freed.

As a result, replaying the events will cause a use after free.

To avoid the issue, make sure to dequeue and free any pending events on
a frozen device when removed.

CVE-2025-26600, ZDI-CAN-25871

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
(cherry picked from commit 6e0f332ba4)

2026-01-25 10:40:01 -08:00

..

.gitignore

Fix spelling/wording issues

2020-07-05 13:07:33 -07:00

atom.c

atom: make FreeAtom static

2015-07-08 16:41:29 -04:00

BuiltInAtoms

…

closestr.h

dix: move closestr.h into dix directory

2026-01-19 12:48:30 -08:00

colormap.c

dix: FindBestPixel: fix implicit fallthrough warning

2026-01-25 10:39:57 -08:00

cursor.c

dix: fix a misused const pointer in cursor.c

2026-01-25 10:39:56 -08:00

devices.c

dix: Dequeue pending events on frozen device on removal

2026-01-25 10:40:01 -08:00

dispatch.c

Cursor: Refuse to free the root cursor

2026-01-25 10:40:00 -08:00

dispatch.h

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

dixfonts.c

dix: SetFontPath: don't set errorValue on Success

2026-01-25 10:39:57 -08:00

dixutils.c

treewide: replace xnfrealloc() calls to XNFrealloc()

2026-01-25 10:39:55 -08:00

enterleave.c

dix: fix button offset when generating DeviceButtonStateNotify events

2026-01-25 10:39:58 -08:00

enterleave.h

mi: reset the PointerWindows reference on screen switch

2023-10-25 00:37:47 +00:00

eventconvert.c

dix: limit checks to MAX_VALUATORS when generating Xi events

2026-01-25 10:39:58 -08:00

events.c

drop not needed includes of geext.h

2026-01-25 10:40:00 -08:00

extension.c

Move sizeof to second argument in calloc calls

2026-01-25 10:39:55 -08:00

gc.c

dix: unexport Ones()

2026-01-25 10:39:57 -08:00

gestures.c

dix: make FreeGrab() NULL tolerant

2026-01-25 10:39:57 -08:00

getevents.c

dix: fix wheel emulation lockup when a negative increment is set

2023-02-20 15:11:23 +10:00

globals.c

include: Remove now-empty site.h

2019-10-30 16:17:04 +00:00

glyphcurs.c

Let calloc handle multiplication

2015-04-21 16:57:07 -07:00

grabs.c

dix: CreateGrab() rename "type" parameter to "eventType"

2026-01-25 10:39:57 -08:00

initatoms.c

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

inpututils.c

xace: typesafe hook function for XACE_DEVICE_ACCESS

2026-01-25 10:39:54 -08:00

main.c

dix: keep a ref to the rootCursor

2026-01-25 10:40:00 -08:00

meson.build

dix: Implement internal gesture state handling

2021-05-30 13:26:39 +03:00

pixmap.c

treewide: fix indentions got broke by recent commit

2026-01-25 10:39:56 -08:00

privates.c

Move sizeof to second argument in calloc calls

2026-01-25 10:39:55 -08:00

property.c

dix: ProcListProperties: skip unneeded work if numProps is 0

2026-01-25 10:39:57 -08:00

protocol.txt

drop remains of DMX

2026-01-19 12:32:20 -08:00

ptrveloc.c

dix: InitPredictableAccelerationScheme: avoid memory leak on failure

2026-01-25 10:39:57 -08:00

region.c

replace _X_INLINE by inline in internal static functions

2024-02-05 19:26:14 +00:00

registry.c

rename remaining RT_* defines to X11_RESTYPE_*

2026-01-19 12:48:30 -08:00

resource.c

dix: HashResourceID: use unsigned integers for bit shifting

2026-01-25 10:39:57 -08:00

selection.c

dix: create empty selection objects as-needed in dixLookupSelection()

2026-01-25 10:39:55 -08:00

stubmain.c

Allow DDX to provide a main()

2013-07-23 23:56:58 +01:00

swaprep.c

Fix spelling/wording issues

2020-07-05 13:07:33 -07:00

swapreq.c

dix: drop swapping request length fields

2026-01-25 10:39:59 -08:00

tables.c

dix: drop swapping request length fields

2026-01-25 10:39:59 -08:00

touch.c

rename remaining RT_* defines to X11_RESTYPE_*

2026-01-19 12:48:30 -08:00

window.c

xace: typesafe hook function for XACE_SCREENSAVER_ACCESS

2026-01-25 10:39:54 -08:00