PT-2026-35037 · Julia · Wayland Jll
Published
2026-04-14
·
Updated
2026-04-14
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl shm pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wayland Jll