ALSA-2026:86907: Important: xorg-x11-server-Xwayland security update

Q: Which listed issue is specifically identified as affecting Xwayland?

CVE-2026-88812 is specifically labeled as an Xwayland issue. It is an arbitrary code execution vulnerability caused by a double-free in XKB geometry handling.

Q: Are all of the listed fixes limited to the Xwayland-specific flaw?

No. The advisory lists eight fixes in total; CVE-2026-88812 is labeled as Xwayland-specific, while the other listed issues are identified as xorg-x11-server vulnerabilities, including arbitrary code execution, privilege escalation, use-after-free, buffer overflow, and out-of-bounds write flaws.

Published Oct 21, 2026

Updated

Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in inputconstraincursor() (CVE-2026-93519) xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

almalinux/xorg-x11-server-xwayland<21.1.3-20.el8_10.4

21.1.3-20.el8_10.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/xorg-x11-server-Xwayland to a version that resolves this vulnerability.
Fixed in 21.1.3-20.el8_10.4

Event History

Oct 21, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which listed issue is specifically identified as affecting Xwayland?

CVE-2026-88812 is specifically labeled as an Xwayland issue. It is an arbitrary code execution vulnerability caused by a double-free in XKB geometry handling.

Are all of the listed fixes limited to the Xwayland-specific flaw?

No. The advisory lists eight fixes in total; CVE-2026-88812 is labeled as Xwayland-specific, while the other listed issues are identified as xorg-x11-server vulnerabilities, including arbitrary code execution, privilege escalation, use-after-free, buffer overflow, and out-of-bounds write flaws.

ALSA-2026:86907: Important: xorg-x11-server-Xwayland security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which listed issue is specifically identified as affecting Xwayland?

Are all of the listed fixes limited to the Xwayland-specific flaw?

Company

Resources

Contact

Frequently Asked Questions

Which listed issue is specifically identified as affecting Xwayland?

Are all of the listed fixes limited to the Xwayland-specific flaw?