This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
* CVE-2026-88812: XKB SetGeometry TextDoodad Double Free
* CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free
* CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free
* CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow
* CVE-2026-93518: XKB ResizeKeyType Numeric Truncation
* CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow
* CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write
* CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow
* CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow
* CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write
* CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
* CVE-2026-93536: GestureBuildSprite Use-After-Free
In addition we have a variety of fixes outlined by the shortlog below.
Alan Coopersmith (12):
gitlab CI: add workflow rules
xkb: Fix -Wcalloc-transposed-args warning in _XkbCopyGeom()
xf86: prevent passing NULL pointer as strcpy destination
xf86: prevent passing NULL pointer as strcat() destination
xf86: silence -Wanalyzer-possible-null-dereference warning in parser
test: silence -Wanalyzer-null-argument warnings in strndup tests
exa: silence -Wold-style-declaration warning from gcc 16
xf86: handle malloc failure in DoSubstitution()
Handle -Wimplicit-fallthrough warnings from gcc 16.1
meson: only install dri3.h if building dri3 support
meson: check cpu_family() instead of cpu()
xf86: mark wasset unused in xf86UnblockSIGIO() compatibility wrapper
Gary T. Giesen (2):
xfree86: set GPU screen FB/DGA defaults on runtime hotplug
config/udev: guard against NULL subsystem in fallback bus id
Jeremy Huddleston Sequoia (9):
xquartz: Activate the app via xp_window_activate() in -set_front_process:
xquartz/GL: Log failures on the indirect GLX make-current path
fb: Don't widen the planemask over padding bits when ROOTLESS_SAFEALPHA
is set
RegionValidate: Fix double free of badreg->data on the error path
damage: Unlink a damage from the list it was actually inserted on
xkb: Guard XkbAdjustGroup() against a keymap with no groups
xkb: Default to one group whenever a keymap reports none
xkb: Never recompute a keymap's group count down to zero
xkb: Keep the group counts of a loaded keymap in range
Lukáš Lipinský (2):
Xi: byte-swap DeviceChanged valuator and scroll data
Xi: byte-swap XIQueryDevice ScrollClass flags
Martin von Gagern (1):
modesetting: Check for NULL mode_output before printing warning message
Michel Dänzer (1):
ci: Prevent duplicate pipelines for MRs
NetSysFire (1):
xorg.conf.man: Fix escape sequence typo
Octavia Togami (1):
Fix use-after-free caused by duplicate glyphs in one glyphset
Peter Hutterer (12):
xkb: NULL text pointer after free in _CheckSetDoodad error path
xkb: allocate names->keys to MAP_LENGTH in XkbAllocNames
xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int
xkb: fix CheckKeySyms overwriting request-range symsPerKey entries
randr: fix size and offset in RRChangeProviderProperty PrependMode
Xi: validate modifier values in ProcXIPassiveUngrabDevice
glx: validate dataBytes against cmdlen in RenderLarge first request
present: unlink notifies from window list in present_clear_window_notifies
dix: remove passive grabs referencing a device on removal
Xi: add bounds check for barrier events in input_constrain_cursor
Xi: clean up gesture sprite traces in WindowGone
xserver 21.1.25
dongshengyuan (1):
enhance: popen-fdopen-error-handling
pkubaj (1):
meson: Fix build on FreeBSD/powerpc*
stefan11111 (1):
glamor: Set `need_free_region` immediately after pixman region allocation
git tag: xorg-server-21.1.25
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.25.tar.gz
SHA256: fdb5ec9b4ab7371745b182b68c7054ed72fc4d13e185fc369cfc45e0c3a174e7
xorg-server-21.1.25.tar.gz
SHA512:
2fdbcca5d28d7a37d68c82c94fced76fdeb80593d2917bb9ccc82dcb3015c4c1c0d639c169ce50182182f6167a81e2ed7977f9447c63d9e509ac6223c1def758
xorg-server-21.1.25.tar.gz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.25.tar.gz.sig
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.25.tar.xz
SHA256: 6ad4e3c7b59a309b32c92e5c15ce1267110f9e13f1ac78da62361a628da1a0eb
xorg-server-21.1.25.tar.xz
SHA512:
ccb807df73fa3bd1eacd0558425010cabeb90c11843b2d895166335823107766bbb14ad4ce33943453b81c689a90134b936572304138c290811d76d5e5d93360
xorg-server-21.1.25.tar.xz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.25.tar.xz.sig
signature.asc
Description: PGP signature
