Most recent entries from all

ALSA-2026:82015 — Important: xorg-x11-server security update

2026-10-27T23:17:46.276979+00:00

Affected: AlmaLinux:9: xorg-x11-server-Xdmx, AlmaLinux:9: xorg-x11-server-Xephyr, AlmaLinux:9: xorg-x11-server-Xnest, AlmaLinux:9: xorg-x11-server-Xorg, AlmaLinux:9: xorg-x11-server-Xvfb, AlmaLinux:9: xorg-x11-server-common, AlmaLinux:9: xorg-x11-server-devel, AlmaLinux:9: xorg-x11-server-source

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Security Fix(es):

* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

fkie_cve-2026-88812

2026-10-27T23:17:46.277081+00:00

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

GHSA-prmg-8fm6-8p8h

2026-10-27T23:17:46.277115+00:00

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

OESA-2026-4468 — xorg-x11-server security update

2026-10-27T23:17:46.277132+00:00

Affected: openEuler:22.03-LTS-SP4: xorg-x11-server

X.Org X11 X server Security Fix(es):

A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges. (From Red Hat.)(CVE-2026-88812)

A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local X client can exploit this flaw by creating cross-window notifications and subsequently destroying the target window. Successful exploitation primarily results in a Denial of Service (DoS) via an X server crash, and may potentially lead to information disclosure.(CVE-2026-93515)

A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the dangling device pointer. This flaw can lead to arbitrary code e…

openSUSE-SU-2026:12104-1 — xorg-x11-server-21.1.24-2.1 on GA media

2026-10-27T23:17:46.277214+00:00

xorg-x11-server-21.1.24-2.1 on GA media

RHSA-2026:86907 — Red Hat Security Advisory: xorg-x11-server-Xwayland security update

2026-10-27T23:17:46.277246+00:00

xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice

SUSE-SU-2026:24230-1 — Security update for xwayland

2026-10-27T23:17:46.277278+00:00

Security update for xwayland

UBUNTU-CVE-2026-88812

2026-10-27T23:17:46.277298+00:00

Affected: Ubuntu:Pro:14.04:LTS: xorg-server, Ubuntu:Pro:16.04:LTS: xorg-server, Ubuntu:Pro:16.04:LTS: xorg-server-hwe-16.04, Ubuntu:Pro:18.04:LTS: xorg-server, Ubuntu:Pro:18.04:LTS: xorg-server-hwe-18.04, Ubuntu:Pro:20.04:LTS: xorg-server, Ubuntu:22.04:LTS: xorg-server, Ubuntu:22.04:LTS: xwayland, Ubuntu:24.04:LTS: xorg-server, Ubuntu:24.04:LTS: xwayland and 4 more

[XKB SetGeometry TextDoodad Double Free]