I am pleased to announce xwayland 26.0.99.903, the third release candidate of the upcoming standalone xwayland 26.1.0 release (or xwayland-26.1.0 RC3 for short).
Testing of this release candidate would be greatly appreciated.
Please report any issues at:
https://gitlab.freedesktop.org/xorg/xserver/-/issues
Along with other backports from the main branch, this includes the
fixes for the issues reported in today's security advisory:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
* CVE-2026-88812: XKB SetGeometry TextDoodad Double Free
* CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free
* CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free
* CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow
* CVE-2026-93518: XKB ResizeKeyType Numeric Truncation
* CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow
* CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write
* CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow
* CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow
* CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write
* CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
* CVE-2026-93536: GestureBuildSprite Use-After-Free
Kevin.Li (1):
glamor: use highp for fill_pos UVs on GLES
Olivier Fourdan (7):
xwayland: Handle libxcvt_gen_mode_info() failure
xwayland: Skip optional RR modes if CVT generation fails
xwayland: Do not fail if cannot add the native or logical mode
xwayland: Update RR modes only if valid
os: Add busfault_set_jmp() for SIGBUS unwind
miext/sync: Handle SIGBUS from truncated shm fences
Bump version to 26.0.99.903
Pavel Ondračka (1):
glamor: free the link log on shader link failure
Peter Hutterer (18):
pyxtest: abstract the present xclients
config: remove the fdi2iclass.py script
Run ruff format against the whole source tree
Ruff check --fix --unsafe-fixes across the tree
Fix remaining ruff check issues
ci: Run ruff check against the whole tree
xkb: NULL text pointer after free in _CheckSetDoodad error path
xkb: allocate names->keys to MAP_LENGTH in XkbAllocNames
xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int
xkb: fix CheckKeySyms overwriting request-range symsPerKey entries
randr: fix size and offset in RRChangeProviderProperty PrependMode
Xi: validate modifier values in ProcXIPassiveUngrabDevice
glx: validate dataBytes against cmdlen in RenderLarge first request
present: unlink notifies from window list in present_clear_window_notifies
dix: remove passive grabs referencing a device on removal
Xi: add bounds check for barrier events in input_constrain_cursor
Xi: clean up gesture sprite traces in WindowGone
glamor: size tmp_bits buffer for source coordinate range in upload_boxes
Pierre Ossman (5):
Generalize glamor dependencies
Remove redundant define
Generalize GBM feature tests
Generalize epoxy feature tests
Expose libxcvt availability to compiled code
stefan11111 (4):
glx: include: meson_options.txt: Allow disabling DRI glx backends
glamor: Restore `GetImage` proc
glamor: Set `need_free_region` immediately after pixman region allocation
glamor/glamor_egl: Add a fallback path to
`glamor_gbm_bo_from_pixmap_internal`
git tag: xwayland-26.0.99.903
https://xorg.freedesktop.org/archive/individual/xserver/xwayland-26.0.99.903.tar.xz
SHA256: fa07af573ff6e6f4b4a656c958b16ee77cafeb28189a8c7a4f384284165b020b
xwayland-26.0.99.903.tar.xz
SHA512:
6665b8f27624df9de61d312cdb367daa417ba64e1881ba12d004e88a22d4aea3eb6846296abf2acee94ef7e58623a75dacac8fae4c9436dda1200ca74f64f3f6
xwayland-26.0.99.903.tar.xz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xwayland-26.0.99.903.tar.xz.sig
OpenPGP_signature.asc
Description: OpenPGP digital signature
