I am pleased to announce xorg-server 26.0.99.903, the third release candidate of the upcoming standalone xorg-server 26.1.0 release (or xorg-server 26.1.0 rc3 for short).
Testing of this release candidate would be greatly appreciated.
Please report any issues at:
https://gitlab.freedesktop.org/xorg/xserver/-/issues
Along with other backports from the main branch, this includes the
the fixes for the issues reported in today's security advisory:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
* CVE-2026-88812: XKB SetGeometry TextDoodad Double Free
* CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free
* CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free
* CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow
* CVE-2026-93518: XKB ResizeKeyType Numeric Truncation
* CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow
* CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write
* CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow
* CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow
* CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write
* CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
* CVE-2026-93536: GestureBuildSprite Use-After-Free
Alan Coopersmith (3):
meson: convert remaining `foo == a or foo == b` to `foo in [a, b]` style
xf86: mark wasset unused in xf86UnblockSIGIO() compatibility wrapper
xorg-server 26.0.99.903 (26.1.0 RC3)
Kevin.Li (1):
glamor: use highp for fill_pos UVs on GLES
Mario Kleiner (2):
modesetting: Restrict hw cursor size optimization to known working hw.
modesetting: Fix RandR output leasing while TearFree is enabled.
Olivier Fourdan (2):
os: Add busfault_set_jmp() for SIGBUS unwind
miext/sync: Handle SIGBUS from truncated shm fences
Pavel Ondračka (1):
glamor: free the link log on shader link failure
Peter Hutterer (19):
xfree86: fix modesetting symbols leak test
pyxtest: abstract the present xclients
config: remove the fdi2iclass.py script
Run ruff format against the whole source tree
Ruff check --fix --unsafe-fixes across the tree
Fix remaining ruff check issues
ci: Run ruff check against the whole tree
xkb: NULL text pointer after free in _CheckSetDoodad error path
xkb: allocate names->keys to MAP_LENGTH in XkbAllocNames
xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int
xkb: fix CheckKeySyms overwriting request-range symsPerKey entries
randr: fix size and offset in RRChangeProviderProperty PrependMode
Xi: validate modifier values in ProcXIPassiveUngrabDevice
glx: validate dataBytes against cmdlen in RenderLarge first request
present: unlink notifies from window list in present_clear_window_notifies
dix: remove passive grabs referencing a device on removal
Xi: add bounds check for barrier events in input_constrain_cursor
Xi: clean up gesture sprite traces in WindowGone
glamor: size tmp_bits buffer for source coordinate range in upload_boxes
Pierre Ossman (7):
Fix fragile check for when to build glamor_egl
Fix incorrect uses of GLAMOR_HAS_GBM
Generalize glamor dependencies
Remove redundant define
Generalize GBM feature tests
Generalize epoxy feature tests
Expose libxcvt availability to compiled code
stefan11111 (4):
glx: include: meson_options.txt: Allow disabling DRI glx backends
glamor: Restore `GetImage` proc
glamor: Set `need_free_region` immediately after pixman region allocation
glamor/glamor_egl: Add a fallback path to
`glamor_gbm_bo_from_pixmap_internal`
git tag: xorg-server-26.0.99.903
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-26.0.99.903.tar.xz
SHA256: e5a7e3d568e1dcf98f305d21f5e5a88dece7a7bb5ac70eb64b2759ca20ade4a0
xorg-server-26.0.99.903.tar.xz
SHA512:
060e6e43931d2b18ea78626fa17a24e2560746fbed4fb410dd013be480434b52cd2632e36231ff3835097bbf3b832e3053019b38374edea48858ee9b6092e6e0
xorg-server-26.0.99.903.tar.xz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-26.0.99.903.tar.xz.sig
--
-Alan Coopersmith- [email protected]
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
signature.asc
Description: PGP signature
