RLSA-2026:98611: Important: libXi security update
X.Org X11 libXi runtime library
Security Fix(es):
libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser (CVE-2026-93543)
libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply (CVE-2026-109090)
libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/libXito a version that resolves this vulnerability.Fixed in 0:1.8.1-7.el10_2.3 - Upgrade
Upgrade
rocky-linux/libXi-debugsourceto a version that resolves this vulnerability.Fixed in 0:1.8.1-7.el10_2.3 - Upgrade
Upgrade
rocky-linux/libXi-develto a version that resolves this vulnerability.Fixed in 0:1.8.1-7.el10_2.3 - Upgrade
Upgrade
rocky-linux/libXi-debuginfoto a version that resolves this vulnerability.Fixed in 0:1.8.1-7.el10_2.3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Rocky Linux systems should be prioritized for remediation?
Systems with the Rocky Linux libXi runtime library installed should be prioritized, especially where the libXi, libXi-devel, libXi-debugsource, or libXi-debuginfo packages are present. The advisory identifies denial-of-service and arbitrary-code-execution issues in libXi.
What access does an attacker need to exploit these issues?
The supplied CVSS vector indicates network-based attack access, no required privileges, high attack complexity, and required user interaction. The data does not specify the exact interaction or application workflow involved.