Red Hat Security Advisory: xorg-x11-server-Xwayland security update

Fixed packages 3

Vulnerabilities 9

• High 7.8
  CVE-2026-50256

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

  A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 by…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50257

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

  A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50258

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

  A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A clien…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50259

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

  A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled o…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50260

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

  A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50261

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

  A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. Th…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50264

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

  An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• Medium 5.5
  CVE-2026-50262

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes

  An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A wri…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• Medium 5.5
  CVE-2026-50263

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()

  A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485380
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485382
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485384
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485385
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485386
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485387
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485388
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2485389
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36633.json
• report
  https://access.redhat.com/security/cve/CVE-2026-50256
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-50256
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-50256
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/bb5158f962dc935e58ef8b4b5fcb31be201a6e07
• article
  https://lists.x.org/archives/xorg-announce/2026-June/003702.html
• article
  https://redhat.atlassian.net/browse/PSIRTSUPT-16950
• report
  https://access.redhat.com/security/cve/CVE-2026-50257
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-50257
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-50257
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b
• report
  https://access.redhat.com/security/cve/CVE-2026-50258
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-50258
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-50258
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/543e108516428fc8c3bea91d6563ad266f9a801e
• report
  https://access.redhat.com/security/cve/CVE-2026-50259
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-50259
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-50259
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/867b59b33bee669cb412f1314e47c52eacf6e00b
• report
  https://access.redhat.com/security/cve/CVE-2026-50260
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-50260
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-50260
• report
  https://access.redhat.com/security/cve/CVE-2026-50261
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-50261
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-50261
• article
  https://gitlab.freedesktop.org/xorg/xserver/-/commit/bdd7bf57af208b1ddf57d4683d67104443b44812
• report
  https://access.redhat.com/security/cve/CVE-2026-50262
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-50262
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-50262