Important: xorg-x11-server-Xwayland security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-93536: GestureBuildSprite() copies raw WindowPtr values into the gesture sprite trace via CopySprite() without any reference counting or lifetime management. WindowGone() only repairs touch sprite traces when a window is destroyed -- gesture sprite traces are never checked or cleaned. This leaves stale WindowPtr references in gesture sprites. When DeliverOneGestureEvent() later dereferences the stale WindowPtr via DeepestSpriteWin(&gi->sprite)->drawable.id, it produces a use-after-free. The freed 4 bytes (drawable.id) can be read back, potentially leaking information about the contents of the freed memory region. NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4c9c345d2a10baf956fdefa83bb88681f7c840cf (xorg-server-21.1.25) CVE-2026-93524: CheckKeySyms() in xkb/xkb.c populates a symsPerKey[] validation array with new key widths for keys in the SetMap request range, then continues filling entries for keys beyond the range. However, the second loop starts at index i = nKeySyms (the first loop's counter) rather than i = firstKeySym + nKeySyms. When firstKeySym is large and nKeySyms is small, the second loop overwrites symsPerKey[target] with the old width from the existing map. CheckKeyActions() then validates the wire action count against the stale old width and accepts it. In _XkbSetMap(), SetKeySyms() widens the key (resizing actions to nGroups * newWidth), but SetKeyActions() then resizes again to the old count. A subsequent XkbGetMap request reads XkbKeyNumActions() entries (derived from the new wider key_sym_map.width) from the shorter action allocation, causing an out-of-bounds heap read. The overread bytes are copied into the GetMap reply and sent back to the requesting client, producing a bounded heap information disclosure. NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/927ee1282d21550807619521bee909ef62ed0571 (xorg-server-21.1.25) CVE-2026-93523: The XI2 passive ungrab path (XIPassiveUngrabDevice) is missing the modifier validation that exists in the grab path and in legacy XI paths. Without checking against AllModifiersMask, a client can supply out-of-range modifier values that lead to an out-of-bounds write when the modifier is used as an index. An authenticated X client can trigger this by sending an XIPassiveUngrabDevice request with an out-of-range modifier value. The out-of-bounds write can lead to arbitrary code execution or denial of service. NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-server-21.1.25) CVE-2026-93522: In glamor's CopyArea CPU-to-FBO path, the temporary buffer (tmp_bits) is sized based on the destination height but is indexed using source coordinates. When the source region is taller than the destination, writes overflow the allocated buffer. An authenticated X client can trigger this by performing a CopyArea operation between drawables with mismatched depth (depth-24 to depth-32 or vice versa) where the source is taller than the destination, on a system using glamor/GPU acceleration. The heap buffer overflow can lead to arbitrary code execution or denial of service. This issue does not affect xorg-server-21.1.x Fixed in: xwayland-24.1.14 Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/ad26c26bf795 CVE-2026-93521: In RRChangeProviderProperty() with PrependMode, new_value.size is set to len instead of total_len. Additionally, the old_data offset calculation uses prop_value->size instead of len for the memcpy of existing data. This causes a heap buffer overflow when prepending property data, as the buffer is undersized and the copy offset is incorrect. This mirrors a bug pattern that was previously fixed in RRChangeOutputProperty but was not applied to the provider property path. An authenticated X client can trigger this by sending RandR ChangeProviderProperty requests with PrependMode on a system with RandR providers (standard on modern GPUs). The heap buffer overflow can lead to arbitrary code execution or denial of service. Fixed in: xorg-server-21.1.25 and xwayland-24.1.14 Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199 CVE-2026-93519: Input_constrain_cursor() writes barrier events into a fixed-size buffer without checking bounds. When more than 100 pointer barriers are active, the writes overflow the fixed buffer on the stack or heap. An authenticated X client can trigger this by creating more than 100 pointer barriers (using the XFIXES extension) and then generating pointer motion events (e.g. via XTEST). Both extensions are enabled by default. The buffer overflow can lead to arbitrary code execution or denial of service. NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9c3880d0745acefc98ed37e79498dfbe558a0f40 (xorg-server-21.1.25) CVE-2026-93518: In XkbResizeKeyType(), the size_syms variable is declared as unsigned short. The expression (nTotal * 15) / 10 can exceed 65535 for large nTotal values, and the result is truncated when assigned to the unsigned short variable. This causes an undersized allocation, and subsequent writes overflow the heap buffer. An authenticated X client can trigger this by sending XKB requests that cause a key type resize with a sufficiently large nTotal value. The heap buffer overflow resulting from the truncated allocation can lead to arbitrary code execution or denial of service. NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/558ba8f784b0f5d4d96948051b2f04c983af20cc (xorg-serv