CVE-2026-108094 Red Hat CVE debrief

Who should care

System administrators and users of affected Red Hat Enterprise Linux systems should assess exposure and prioritize patching or verification. This includes reviewing system deployments, verifying affected scope, and applying vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

A use-after-free flaw in mutter's Wayland color-management ICC image-description path can crash the GNOME session and potentially allow code execution. System administrators and users of affected Red Hat Enterprise Linux systems should assess exposure and prioritize patching or verification.

• Potential crashes of the GNOME session
• Possible arbitrary code execution within the compositor process
• Need for verification of affected systems and patching or updates

Technical summary

The vulnerability is caused by a use-after-free flaw in the Wayland color-management ICC image-description path. A local attacker can exploit this by running a malicious Wayland client, potentially crashing the GNOME session or executing arbitrary code within the compositor process. This issue affects mutter in the Wayland color-management ICC image-description path, and system administrators should assess exposure and prioritize patching or verification for affected Red Hat Enterprise Linux systems. The flaw can be triggered by a client destroying a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress.

Defensive priority

High-priority patching and verification recommended for affected systems

Recommended defensive actions

• Apply patches or updates from the vendor to address the vulnerability
• Verify that affected systems are patched or updated
• Monitor systems for potential crashes or unusual behavior
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. The source item from cve_program_cvelist_v5 provides additional metadata. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and review vendor guidance for patching or updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.