Present_clear_window_notifies() does not unlink notify entries from the per-window list before freeing window_priv. When the window is subsequently destroyed or reused, the stale list entries are traversed, resulting in a use-after-free.

An authenticated X client can trigger this by creating cross-window Present notifies and then destroying the target window. Both the Present and SYNC extensions must be enabled (they are by default).
The use-after-free can lead to denial of service (crash) or potentially information disclosure.

NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a469f98bcfab50dab607ff5ac24037632b0079a3 (xorg-server-21.1.25)