Bug 2549512

Summary:	CVE-2026-108094 mutter: mutter: client-triggered use-after-free in Wayland color-management ICC image description path [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Srikanth Balasubramanian <sbalasub>
Component:	mutter	Assignee:	GNOME SIG Unassigned <gnome-sig>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	avovk, development.group, fmuellner, gnome-sig, jadahl, mdaenzer, otaylor, walters
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["3527c2a4-87ce-496f-945c-7eec37c181ee"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-21 02:22:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2549511

Description Srikanth Balasubramanian 2026-10-12 10:38:26 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Summary: client-triggered use-after-free of a wp_image_description_v1 wl_resource in the async ICC path

Requirements to exploit: A local unprivileged Wayland client that can connect to the compositor's Wayland socket ($XDG_RUNTIME_DIR/wayland-N), including Flatpak/Snap apps with Wayland access. The client binds wp_color_manager_v1, creates an ICC image description (create_icc_creator → set_icc_file → create), then destroys the wp_image_description_v1 resource while the asynchronous ICC file read is still in flight (create+destroy can be batched in one sendmsg). No elevated privileges beyond normal session client access are required.

Component affected: mutter (src/wayland/meta-wayland-color-management.c — creator_icc_create / on_icc_create_bytes_read)

Version affected (maintainer): >= 47.0, < 51.0
Version fixed (maintainer): 51.0

Code-path note: The vulnerable pattern (unowned creator_icc->image_desc_resource used after destroy in on_icc_create_bytes_read) is present from mutter 49.rc through 50.4. It is not present in 47.x/48.x. Fixed code (refcounted MetaWaylandImageDescription; resource cleared on destroy) is in 50.5 and 51.0.

Patch available: Yes
Upstream fix: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5313
Key commit: 86141ab75b23 ("wayland/color-management: Fix lifetime of ICC image description"), merged 2026-09-11
Upstream report: https://gitlab.gnome.org/GNOME/mutter/-/issues/5025
Embargo: No
Acknowledgment: Calif.io, in collaboration with Anthropic

Comment 1 Adrian Vovk 2026-10-21 02:22:58 UTC

In addition to the fix versions listed in the tracker, the fix was also backported to mutter 49.8

We're already shipping:
rawhide and f45 are 51.1
f44 is 50.6
f43 is 49.8

Thus, nothing left to do!