# X.Org Server 21.1.25 and Xwayland 24.1.14 patch two security vulnerabilities

> **Key takeaway:** X.Org Server 21.1.25 and Xwayland 24.1.14 fix CVE-2026-88812, a double free enabling arbitrary code execution, and CVE-2026-93515, a use-after-free that can crash the server or leak information.

**Published:** 2026-10-20T07:39:03+00:00 
**Source:** Linux Today 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/xorg-server-21125-and-xwayland-24114-patch-two-security-vuln.html 

## Summary
New releases of X.Org Server and Xwayland address two CVE-assigned security flaws. CVE-2026-88812 is a double free in XKB SetGeometry TextDoodad processing that can cause heap corruption, leading to arbitrary code execution or denial of service. CVE-2026-93515 is a use-after-free in the Present extension's cross-window notify path that can crash the server or potentially disclose information. Both packages are core display infrastructure for Linux and other Unix-like systems.

## What the two CVEs affect
- **CVE-2026-88812**: Double free in XKB SetGeometry TextDoodad handling → heap corruption → arbitrary code execution or DoS crash
- **CVE-2026-93515**: Use-after-free in Present extension cross-window notify → DoS crash or potential information disclosure
- Xwayland 24.1.14 carries the same fixes for X11 compatibility on Wayland compositors

## Why it matters
Virtually all Linux desktop installations run either X.Org Server or Xwayland, making these fixes broadly relevant. Distributors should prioritize updates, particularly for multi-user systems where the XKB code path is reachable.