RLSA-2026:98487: Important: xorg-x11-server security update
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Security Fix(es):
xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in inputconstraincursor() (CVE-2026-93519)
xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/xorg-x11-server-commonto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-develto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xdmxto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xdmx-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xephyrto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xephyr-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xnestto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xnest-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xorgto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xorg-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xvfbto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-Xvfb-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9 - Upgrade
Upgrade
rocky-linux/xorg-x11-server-sourceto a version that resolves this vulnerability.Fixed in 0:1.20.11-39.el9_9
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What level of access does an attacker need to exploit the listed issues?
The severity vector indicates local attack access, low attack complexity, low privileges required, and no user interaction. An attacker would need local access and an existing low-privileged account or process context.
What could successful exploitation allow?
The listed fixes include arbitrary code execution, privilege escalation, buffer overflows, use-after-free, double-free, and out-of-bounds write conditions. The supplied severity vector rates the potential impact on confidentiality, integrity, and availability as high.
Which installed components should be reviewed for exposure?
Review installations of the listed Rocky Linux xorg-x11-server packages: xorg-x11-server-common, -debuginfo, -debugsource, -devel, -xdmx, -xdmx-debuginfo, -xephyr, and -xephyr-debuginfo. The advisory also identifies an issue affecting xwayland, but no xwayland package name is provided in the package list.