Bug 2549511 (CVE-2026-108094)

Summary:	CVE-2026-108094 mutter: mutter: client-triggered use-after-free in Wayland color-management ICC image description path
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2549512
Bug Blocks:

Description OSIDB Bzimport 2026-10-12 10:36:52 UTC

Summary: client-triggered use-after-free of a wp_image_description_v1 wl_resource in the async ICC path

Requirements to exploit: A local unprivileged Wayland client that can connect to the compositor's Wayland socket ($XDG_RUNTIME_DIR/wayland-N), including Flatpak/Snap apps with Wayland access. The client binds wp_color_manager_v1, creates an ICC image description (create_icc_creator → set_icc_file → create), then destroys the wp_image_description_v1 resource while the asynchronous ICC file read is still in flight (create+destroy can be batched in one sendmsg). No elevated privileges beyond normal session client access are required.

Component affected: mutter (src/wayland/meta-wayland-color-management.c — creator_icc_create / on_icc_create_bytes_read)

Version affected (maintainer): >= 47.0, < 51.0
Version fixed (maintainer): 51.0

Code-path note: The vulnerable pattern (unowned creator_icc->image_desc_resource used after destroy in on_icc_create_bytes_read) is present from mutter 49.rc through 50.4. It is not present in 47.x/48.x. Fixed code (refcounted MetaWaylandImageDescription; resource cleared on destroy) is in 50.5 and 51.0.

Patch available: Yes
Upstream fix: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5313
Key commit: 86141ab75b23 ("wayland/color-management: Fix lifetime of ICC image description"), merged 2026-09-11
Upstream report: https://gitlab.gnome.org/GNOME/mutter/-/issues/5025
Embargo: No
Acknowledgment: Calif.io, in collaboration with Anthropic