Bug 2496193 (CVE-2026-56000)

CommonMakeCurrent() in the GLX dispatch layer captures a pointer into the per-client cl->contextTags array by calling GlxLookupContextTag(). This returns a direct pointer into an array later realloced. If realloc() moves the buffer to a new location, the previously captured oldTag pointer becomes dangling. The subsequent GlxFreeContextTag(oldTag) then writes zeros into freed heap memory (use-after-free). Five fields are zeroed at fixed offsets (16, 24, 32, 36, 40 bytes) within the stale slot. A malicious client can force the realloc by creating 16 GLX contexts with MakeCurrent(oldContextTag=0) to fill all tag slots to capacity, then issuing a 17th MakeCurrent with a non-zero oldContextTag. This triggers the realloc while oldTag points into the old buffer. The attack requires only 34 X11 requests (17 CreateContext + 17 MakeCurrent) from a single client.