This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
* CVE-2026-88812: XKB SetGeometry TextDoodad Double Free
* CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free
* CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free
* CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow
* CVE-2026-93518: XKB ResizeKeyType Numeric Truncation
* CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow
* CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write
* CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow
* CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow
* CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write
* CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
* CVE-2026-93536: GestureBuildSprite Use-After-Free
In addition we have a variety of fixes outlined by the shortlog below.
Alan Coopersmith (3):
xkb: Fix -Wcalloc-transposed-args warning in _XkbCopyGeom()
test: silence -Wanalyzer-null-argument warnings in strndup tests
Handle -Wimplicit-fallthrough warnings from gcc 16.1
Jeremy Huddleston Sequoia (6):
RegionValidate: Fix double free of badreg->data on the error path
damage: Unlink a damage from the list it was actually inserted on
xkb: Guard XkbAdjustGroup() against a keymap with no groups
xkb: Default to one group whenever a keymap reports none
xkb: Never recompute a keymap's group count down to zero
xkb: Keep the group counts of a loaded keymap in range
Leon M. Busch-George (1):
xwayland/glamor/gbm: get_render_node_path without enumeration
Lukáš Lipinský (2):
Xi: byte-swap DeviceChanged valuator and scroll data
Xi: byte-swap XIQueryDevice ScrollClass flags
Michel Dänzer (1):
xwayland/present: Only flip if the window pixmap dimensions match
Octavia Togami (1):
Fix use-after-free caused by duplicate glyphs in one glyphset
Olivier Fourdan (5):
xwayland: Skip xwl_cursor_warped_to() without an xwl_seat
xwayland: Handle libxcvt_gen_mode_info() failure
xwayland: Skip optional RR modes if CVT generation fails
xwayland: Do not fail if cannot add the native or logical mode
xwayland: Update RR modes only if valid
Pavel Ondračka (1):
xwayland: let glamor initialize SHM fences
Peter Hutterer (13):
xkb: NULL text pointer after free in _CheckSetDoodad error path
xkb: allocate names->keys to MAP_LENGTH in XkbAllocNames
xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int
xkb: fix CheckKeySyms overwriting request-range symsPerKey entries
randr: fix size and offset in RRChangeProviderProperty PrependMode
Xi: validate modifier values in ProcXIPassiveUngrabDevice
glx: validate dataBytes against cmdlen in RenderLarge first request
present: unlink notifies from window list in present_clear_window_notifies
dix: remove passive grabs referencing a device on removal
Xi: add bounds check for barrier events in input_constrain_cursor
Xi: clean up gesture sprite traces in WindowGone
glamor: size tmp_bits buffer for source coordinate range in upload_boxes
Bump version to 24.1.24
dongshengyuan (1):
enhance: popen-fdopen-error-handling
stefan11111 (1):
glamor: Set `need_free_region` immediately after pixman region allocation
git tag: xwayland-24.1.14
https://xorg.freedesktop.org/archive/individual/xserver/xwayland-24.1.14.tar.xz
SHA256: 4eb6b98d678299a4b96138d886345b294130695760345ef84596225a8224078a
xwayland-24.1.14.tar.xz
SHA512:
0c09214bf5478697430db3f403ba6fc5b669faab4428a902ce9e148ea5dae630798da03f2977ab937486a07224fa2e73d146e3f51fff8abe00d2dd78d5a05bf1
xwayland-24.1.14.tar.xz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xwayland-24.1.14.tar.xz.sig
signature.asc
Description: PGP signature
