Title: X.Org Server 21.1.26 and Xwayland 24.1.15 Fix Eight X Server Security Issues
Summary: X.Org released xorg-server 21.1.26 and xwayland 24.1.15 on November 10, 2026, closing eight security issues in the X server, per the project’s advisory posted by Olivier Fourdan of Red Hat. Everything on the list is fixed in both releases. A hostile monitor can push extra EDID Display-Range (DS_RANGES) records past the fixed hsync/vrefresh capacity of the server’s monitor record (CVE-2026-109091). XvShmPutImage’s shared-memory bounds check can be defeated when the DDX reports a negative size that makes the size-plus-offset addition wrap, handing PutImage an invalid source pointer (CVE-2026-109092). XTestFakeInput wrote DeviceValuator fields into a fixed-size stack array before confirming they fit (CVE-2026-109093). Two XRes handlers multiply numSpecs against the spec size with no overflow guard, so on 32-bit builds a large count wraps and the handlers read past the request buffer — QueryClientIds (CVE-2026-109904) and the QueryResourceBytes swap path (CVE-2026-109094). glamor computes NV12/YV12 image sizes with 32-bit ints, so oversized dimensions wrap to a small value and PutImage requests clear the protocol length checks despite carrying no payload (CVE-2026-109095). XvPutImage likewise accepts a request with no image data when the DDX hands back a negative size (CVE-2026-109096). Finally, XvQueryImageAttributes casts a negative size to CARD32 in its reply, advertising a bogus data size clients may use to size their buffers (CVE-2026-109903). Credit for the reports goes to Eun0us/Espilon, Acts1631 and Tristan Madani (Talence Security); the advisory links per-CVE fix commits on freedesktop GitLab and describes no exploitation in the wild. Install the new packages from your distribution’s stable repositories as they land.
References: