Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Summary: client-triggered use-after-free of a wp_image_description_v1 wl_resource in the async ICC path Requirements to exploit: A local unprivileged Wayland client that can connect to the compositor's Wayland socket ($XDG_RUNTIME_DIR/wayland-N), including Flatpak/Snap apps with Wayland access. The client binds wp_color_manager_v1, creates an ICC image description (create_icc_creator → set_icc_file → create), then destroys the wp_image_description_v1 resource while the asynchronous ICC file read is still in flight (create+destroy can be batched in one sendmsg). No elevated privileges beyond normal session client access are required. Component affected: mutter (src/wayland/meta-wayland-color-management.c — creator_icc_create / on_icc_create_bytes_read) Version affected (maintainer): >= 47.0, < 51.0 Version fixed (maintainer): 51.0 Code-path note: The vulnerable pattern (unowned creator_icc->image_desc_resource used after destroy in on_icc_create_bytes_read) is present from mutter 49.rc through 50.4. It is not present in 47.x/48.x. Fixed code (refcounted MetaWaylandImageDescription; resource cleared on destroy) is in 50.5 and 51.0. Patch available: Yes Upstream fix: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5313 Key commit: 86141ab75b23 ("wayland/color-management: Fix lifetime of ICC image description"), merged 2026-09-11 Upstream report: https://gitlab.gnome.org/GNOME/mutter/-/issues/5025 Embargo: No Acknowledgment: Calif.io, in collaboration with Anthropic
In addition to the fix versions listed in the tracker, the fix was also backported to mutter 49.8 We're already shipping: rawhide and f45 are 51.1 f44 is 50.6 f43 is 49.8 Thus, nothing left to do!