Description
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xorg-server | 2:21.1.23-1 | — |
| Debian 14 | xwayland | 2:24.1.12-1 | — |
| Debian 13 | xorg-server | 2:21.1.16-1.3+deb13u3 | — |
| Debian 13 | xwayland | No fix yet | — |
| Debian 12 | xorg-server | 2:21.1.7-3+deb12u13 | — |
| Debian 12 | xwayland | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | xwayland +1 | No fix yet | — |
| Ubuntu 26.04 LTS | xwayland +1 | No fix yet | — |
| Ubuntu 25.10 | xwayland +1 | No fix yet | — |
| Ubuntu 24.04 LTS | xwayland +1 | No fix yet | — |
| Ubuntu 22.04 LTS | xwayland +1 | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | xorg-server | No fix yet | — |
| Ubuntu Pro 18.04 LTS | xorg-server +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | xorg-server +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | xorg-server | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | xorg-x11-server-Xwayland +1 | 24.1.9-4.el10_2.2 | RHSA-2026:26566 |
| RHEL 9 | tigervnc +6 | 1.15.0-7.el9_8.2 | RHSA-2026:29844 |
| RHEL 9 | xorg-x11-server +8 | 1.20.11-34.el9_8.2 | RHSA-2026:26610 |
| RHEL 9 | xorg-x11-server-Xwayland +1 | 24.1.9-4.el9_8.2 | RHSA-2026:26590 |
| RHEL 8 | tigervnc +6 | 1.15.0-10.el8_10 | RHSA-2026:28923 |
| RHEL 8 | xorg-x11-server +8 | 1.20.11-28.el8_10.2 | RHSA-2026:26709 |
| RHEL 8 | xorg-x11-server-Xwayland | 21.1.3-20.el8_10.2 | RHSA-2026:26562 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | xorg-x11-server-Xwayland +1 | 24.1.5-6.el10_0.1 | RHSA-2026:36798 |
| RHEL 9.6 EUS | tigervnc +6 | 1.14.1-11.el9_6 | RHSA-2026:46392 |
| RHEL 9.6 EUS | xorg-x11-server +8 | 1.20.11-34.el9_6 | RHSA-2026:36085 |
| RHEL 9.6 EUS | xorg-x11-server-Xwayland +1 | 23.2.7-6.el9_6.1 | RHSA-2026:36634 |
| RHEL 9.4 E4S | tigervnc +6 | 1.13.1-8.el9_4.10 | RHSA-2026:46456 |
| RHEL 9.4 E4S | xorg-x11-server +6 | 1.20.11-29.el9_4 | RHSA-2026:36087 |
| RHEL 9.4 E4S | xorg-x11-server-Xwayland | 22.1.9-8.el9_4.1 | RHSA-2026:36632 |
| RHEL 9.2 E4S | tigervnc +6 | 1.12.0-14.el9_2.15 | RHSA-2026:46377 |
| RHEL 9.2 E4S | xorg-x11-server +6 | 1.20.11-21.el9_2 | RHSA-2026:36086 |
| RHEL 9.2 E4S | xorg-x11-server-Xwayland | 21.1.3-10.el9_2.1 | RHSA-2026:36633 |
| RHEL 8.8 TUS | tigervnc +6 | 1.12.0-15.el8_8.18 | RHSA-2026:46385 |
| RHEL 8.8 TUS | xorg-x11-server +6 | 1.20.11-19.el8_8 | RHSA-2026:36768 |
| RHEL 8.8 TUS | xorg-x11-server-Xwayland | 21.1.3-13.el8_8.1 | RHSA-2026:38502 |
| RHEL 8.8 E4S | tigervnc +6 | 1.12.0-15.el8_8.18 | RHSA-2026:46385 |
| RHEL 8.8 E4S | xorg-x11-server +6 | 1.20.11-19.el8_8 | RHSA-2026:36768 |
| RHEL 8.8 E4S | xorg-x11-server-Xwayland | 21.1.3-13.el8_8.1 | RHSA-2026:38502 |
| RHEL 8.6 EUS Long Life | tigervnc +6 | 1.12.0-6.el8_6.18 | RHSA-2026:46460 |
| RHEL 8.6 EUS Long Life | xorg-x11-server +6 | 1.20.11-8.el8_6 | RHSA-2026:36791 |
| RHEL 8.6 EUS Long Life | xorg-x11-server-Xwayland | 21.1.3-2.el8_6.7 | RHSA-2026:38810 |
| RHEL 8.6 AUS | tigervnc +6 | 1.12.0-6.el8_6.18 | RHSA-2026:46460 |
| RHEL 8.6 AUS | xorg-x11-server +6 | 1.20.11-8.el8_6 | RHSA-2026:36791 |
| RHEL 8.6 AUS | xorg-x11-server-Xwayland | 21.1.3-2.el8_6.7 | RHSA-2026:38810 |
| RHEL 8.4 EUS Long Life | tigervnc +6 | 1.11.0-8.el8_4.16 | RHSA-2026:46382 |
| RHEL 8.4 EUS Long Life | xorg-x11-server +7 | 1.20.10-5.el8_4 | RHSA-2026:36792 |
| RHEL 8.4 AUS | tigervnc +6 | 1.11.0-8.el8_4.16 | RHSA-2026:46382 |
| RHEL 8.4 AUS | xorg-x11-server +7 | 1.20.10-5.el8_4 | RHSA-2026:36792 |
| RHEL 7 ELS | tigervnc +6 | 1.8.0-36.el7_9.5 | RHSA-2026:46473 |
| RHEL 7 ELS | xorg-x11-server +9 | 1.20.4-35.el7_9 | RHSA-2026:36083 |
| RHEL 6 ELS | tigervnc +3 | 1.1.0-25.el6_10.18 | RHSA-2026:49519 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | xorg-x11-server-Xwayland +1 | 24.1.9-4.el10_2.2 | ALSA-2026:26566 |
| AlmaLinux 9 | tigervnc +6 | 1.15.0-7.el9_8.2 | ALSA-2026:29844 |
| AlmaLinux 9 | xorg-x11-server-Xdmx +7 | 1.20.11-34.el9_8.2 | ALSA-2026:26610 |
| AlmaLinux 9 | xorg-x11-server-Xwayland +1 | 24.1.9-4.el9_8.2 | ALSA-2026:26590 |
| AlmaLinux 8 | tigervnc +6 | 1.15.0-10.el8_10 | ALSA-2026:28923 |
| AlmaLinux 8 | xorg-x11-server-Xdmx +7 | 1.20.11-28.el8_10.2 | ALSA-2026:26709 |
| AlmaLinux 8 | xorg-x11-server-Xwayland | 21.1.3-20.el8_10.2 | ALSA-2026:26562 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | xorg-x11-server-Xwayland | 24.1.9-4.el10_2.2 | RLSA-2026:26566 |
| Rocky Linux 9 | tigervnc | 1.15.0-7.el9_8.2 | RLSA-2026:29844 |
| Rocky Linux 9 | xorg-x11-server | 1.20.11-34.el9_8.2 | RLSA-2026:26610 |
| Rocky Linux 9 | xorg-x11-server-Xwayland | 24.1.9-4.el9_8.2 | RLSA-2026:26590 |
| Rocky Linux 8 | tigervnc | 1.15.0-10.el8_10 | RLSA-2026:28923 |
| Rocky Linux 8 | xorg-x11-server | 1.20.11-28.el8_10.2 | RLSA-2026:26709 |
| Rocky Linux 8 | xorg-x11-server-Xwayland | 21.1.3-20.el8_10.2 | RLSA-2026:26562 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | tigervnc +6 | 1.14.1-3.amzn2023.0.6 | ALAS2023-2026-1892 |
| Amazon Linux 2023 | xorg-x11-server-Xorg +6 | 21.1.13-5.amzn2023.0.10 | ALAS2023-2026-1790 |
| Amazon Linux 2023 | xorg-x11-server-Xwayland +1 | 24.1.3-1.amzn2023.0.5 | ALAS2023-2026-1789 |
| Amazon Linux 2 | xorg-x11-server-Xdmx +8 | 1.20.4-22.amzn2.0.12 | ALAS2-2026-3336 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | xorg-x11-server | No fix yet | — |
| Azure Linux 3 | xorg-x11-server-Xwayland | 24.1.12-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | xorg-x11-server-Xwayland +1 | 24.1.9-4.el10_2.2 | ELSA-2026-26566 |
| Oracle Linux 9 | tigervnc +6 | 1.15.0-7.el9_8.2 | ELSA-2026-29844 |
| Oracle Linux 9 | xorg-x11-server-Xdmx +7 | 1.20.11-34.el9_8.2 | ELSA-2026-26610 |
| Oracle Linux 9 | xorg-x11-server-Xwayland +1 | 24.1.9-4.el9_8.2 | ELSA-2026-26590 |
| Oracle Linux 8 | tigervnc +6 | 1.15.0-10.el8_10 | ELSA-2026-28923 |
| Oracle Linux 8 | xorg-x11-server-Xdmx +7 | 1.20.11-28.el8_10.2 | ELSA-2026-26709 |
| Oracle Linux 8 | xorg-x11-server-Xwayland | 21.1.3-20.el8_10.2 | ELSA-2026-26562 |
| Oracle Linux 7 | xorg-x11-server-Xdmx +8 | 1.20.4-29.0.9.el7_9 | ELSA-2026-36083 |
Advisories 50
- WID-SEC-2026-2455 Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2026-1774 X.Org X11 und Xwayland: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:29844 Important: tigervnc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26590 Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26610 Important: xorg-x11-server security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26566 Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:28923 Important: tigervnc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26709 Important: xorg-x11-server security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26562 Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:49519 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:46473 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:46456 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:46460 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:46392 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:46385 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:46382 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:46377 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:38810 Red Hat Security Advisory: xorg-x11-server-Xwayland security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:38502 Red Hat Security Advisory: xorg-x11-server-Xwayland security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36798 Red Hat Security Advisory: xorg-x11-server-Xwayland security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36791 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36792 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36768 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36633 Red Hat Security Advisory: xorg-x11-server-Xwayland security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36634 Red Hat Security Advisory: xorg-x11-server-Xwayland security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36632 Red Hat Security Advisory: xorg-x11-server-Xwayland security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36087 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36085 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36086 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:36083 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:29844 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:28923 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:26709 Red Hat Security Advisory: xorg-x11-server security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:26610 Red Hat Security Advisory: xorg-x11-server security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:26566 Red Hat Security Advisory: xorg-x11-server-Xwayland security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:26590 Red Hat Security Advisory: xorg-x11-server-Xwayland security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- RHSA-2026:26562 Red Hat Security Advisory: xorg-x11-server-Xwayland security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 29, 2026
- ELSA-2026-36083 Important: xorg-x11-server security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2026
- ELSA-2026-26566 Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- RLSA-2026:29844 Important: tigervnc security update Rocky Linux Security Advisories · Jun 26, 2026
- RLSA-2026:28923 Important: tigervnc security update Rocky Linux Security Advisories · Jun 25, 2026
- ELSA-2026-29844 Important: tigervnc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 25, 2026
- RLSA-2026:26566 Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update Rocky Linux Security Advisories · Jun 24, 2026
- ELSA-2026-28923 Important: tigervnc security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 24, 2026
- ELSA-2026-26610 Important: xorg-x11-server security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- ELSA-2026-26590 Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- ALAS2023-2026-1892 Important: tigervnc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- RLSA-2026:26562 Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update Rocky Linux Security Advisories · Jun 19, 2026
- RLSA-2026:26590 Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update Rocky Linux Security Advisories · Jun 19, 2026
- RLSA-2026:26610 Important: xorg-x11-server security, bug fix, and enhancement update Rocky Linux Security Advisories · Jun 19, 2026
References
- RHSA-2026:26562 vendor-advisory
- RHSA-2026:26566 vendor-advisory
- RHSA-2026:26590 vendor-advisory
- RHSA-2026:26610 vendor-advisory
- RHSA-2026:26709 vendor-advisory
- RHSA-2026:28923 vendor-advisory
- RHSA-2026:29844 vendor-advisory
- RHSA-2026:36083 vendor-advisory
- RHSA-2026:36085 vendor-advisory
- RHSA-2026:36086 vendor-advisory
- RHSA-2026:36087 vendor-advisory
- RHSA-2026:36632 vendor-advisory
- RHSA-2026:36633 vendor-advisory
- RHSA-2026:36634 vendor-advisory
- RHSA-2026:36768 vendor-advisory
- RHSA-2026:36791 vendor-advisory
- RHSA-2026:36792 vendor-advisory
- RHSA-2026:36798 vendor-advisory
- RHSA-2026:38502 vendor-advisory
- RHSA-2026:38810 vendor-advisory
- RHSA-2026:46377 vendor-advisory
- RHSA-2026:46382 vendor-advisory
- RHSA-2026:46385 vendor-advisory
- RHSA-2026:46392 vendor-advisory
- RHSA-2026:46456 vendor-advisory
- RHSA-2026:46460 vendor-advisory
- RHSA-2026:46473 vendor-advisory
- RHSA-2026:49519 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-50258 vdb-entry
- RHBZ#2485383 issue-tracking
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/543e108516428fc8c3bea91d6563ad266f9a801e
- https://lists.x.org/archives/xorg-announce/2026-June/003702.html
- https://redhat.atlassian.net/browse/PSIRTSUPT-16950