X.Org Server 21.1.25 and Xwayland 24.1.14 patch two security vulnerabilities
X.Org Server 21.1.25 and Xwayland 24.1.14 fix CVE-2026-88812, a double free enabling arbitrary code execution, and CVE-2026-93515, a use-after-free that can crash the server or leak information.
Summary
New releases of X.Org Server and Xwayland address two CVE-assigned security flaws. CVE-2026-88812 is a double free in XKB SetGeometry TextDoodad processing that can cause heap corruption, leading to arbitrary code execution or denial of service. CVE-2026-93515 is a use-after-free in the Present extension's cross-window notify path that can crash the server or potentially disclose information. Both packages are core display infrastructure for Linux and other Unix-like systems.
What the two CVEs affect
- CVE-2026-88812: Double free in XKB SetGeometry TextDoodad handling → heap corruption → arbitrary code execution or DoS crash
- CVE-2026-93515: Use-after-free in Present extension cross-window notify → DoS crash or potential information disclosure
- Xwayland 24.1.14 carries the same fixes for X11 compatibility on Wayland compositors
Why it matters
Virtually all Linux desktop installations run either X.Org Server or Xwayland, making these fixes broadly relevant. Distributors should prioritize updates, particularly for multi-user systems where the XKB code path is reachable.
What to do
- Update X.Org Server to version 21.1.25.
- Update Xwayland to version 24.1.14.
- Watch for distribution security updates if you run Linux or other Unix-like systems using X11 or Xwayland.
Original reference: www.linuxtoday.com →