Check your X.Org server version because a dozen vulnerabilities have been patched

X.Org has released fixes for a dozen security issues affecting the X server and Xwayland, bundled into xorg-server 21.1.25 and xwayland-24.1.14. Nine of the flaws could allow arbitrary code execution, while the remaining three may crash the server or leak information.

Most of the issues (ten out of twelve) require an already-authenticated X client to trigger them, though CVE-2026-93524 and CVE-2026-93536 don't list that requirement. Eleven of the twelve bugs hit both the X server and Xwayland, with CVE-2026-93522 — a heap buffer overflow in Glamor's CopyArea routine on GPU-accelerated setups — affecting Xwayland only.

The root causes vary: seven are buffer overflows or out-of-bounds writes, three are use-after-free conditions, one is a double-free, and one is an out-of-bounds read. Two bugs rely on commonly enabled extensions — CVE-2026-93515 needs Present and SYNC active, while CVE-2026-93519 requires XFIXES, XTEST, and more than 100 live pointer barriers. Two fixes also close gaps left by earlier patches: CVE-2026-93520 completes a fix started in commit a3171732d, and CVE-2026-93521 mirrors a previously patched issue in RRChangeOutputProperty that had only been addressed for the RandR output path, not the provider path.

Administrators running X server or Xwayland should check their installed version against 21.1.25 and 24.1.14 respectively and apply the update, since there is no indication the flaws are being exploited yet but code execution risk makes patching a priority.