This Red Hat security advisory addresses multiple high-severity vulnerabilities (CVSS 7.8) in the X.Org X server and Xwayland, including stack buffer overflows and use-after-free flaws that could lead to privilege escalation or information disclosure. The vulnerabilities affect X.Org X Server versions prior to 21.1.23 and Xwayland versions prior to 24.1.12, as well as multiple Red Hat Enterprise Linux versions. The fix is to apply the provided Red Hat update packages, which contain the patched versions.
Red Hat Product Errata RHSA-2026:36086 - Security Advisory Issued: 2026-07-07 Updated: 2026-07-07 RHSA-2026:36086 - Security Advisory Overview Updated Packages Synopsis Important: xorg-x11-server security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for xorg-x11-server is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.2 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x Fixes BZ - 2485380 - CVE-2026-50256 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch BZ - 2485382 - CVE-2026-50257 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() BZ - 2485383 - CVE-2026-50258 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels BZ - 2485384 - CVE-2026-50259 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing BZ - 2485385 - CVE-2026-50260 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() BZ - 2485386 - CVE-2026-50261 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() BZ - 2485387 - CVE-2026-50262 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes BZ - 2485388 - CVE-2026-50263 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() BZ - 2485389 - CVE-2026-50264 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat CVEs CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.2 SRPM xorg-x11-server-1.20.11-21.el9_2.src.rpm SHA-256: 915e31b0ee368650c650a1afc60590a8ca2947ccff3a5d499d47d005a31b3cc8 x86_64 xorg-x11-server-Xdmx-1.20.11-21.el9_2.x86_64.rpm SHA-256: da53bd21fb1716ead558afc33e35d9e56bc1acbd8879fb9cd9bf205a3dff63f3 xorg-x11-server-Xdmx-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: 8efc6d981f8d97631ae20fa2b558c96b323c2c5b42687d4ad267941763698461 xorg-x11-server-Xephyr-1.20.11-21.el9_2.x86_64.rpm SHA-256: 00d5e64cd448ab4e52b7fab21e2d402f57e426d03b1667efa4c4d89440d046c3 xorg-x11-server-Xephyr-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: 8cc3eaa8c62437910dadf582fc0f38e138ffa878617de74a5734d7c7ce3fab82 xorg-x11-server-Xnest-1.20.11-21.el9_2.x86_64.rpm SHA-256: 7197da0b11efe1bd23abbfc54d53e7ceb97602b751da050676956756d47aec6a xorg-x11-server-Xnest-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: 0dedd60cf224c411be7315c42e749cb9d2729734028b719e184e081932a112d5 xorg-x11-server-Xorg-1.20.11-21.el9_2.x86_64.rpm SHA-256: 4e1606bf9ae742f241f549c9e0cf1a2353746232cde3de4fa7112459189bb823 xorg-x11-server-Xorg-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: 42b2af42e4710381bc7fb72dbc58be035f242a96852abb7e0698ee75e27e4fe6 xorg-x11-server-Xvfb-1.20.11-21.el9_2.x86_64.rpm SHA-256: f45ac0ce5d58d33da12f51b24cc2961b993c1a8ce1b871b1003b99c0235b5bda xorg-x11-server-Xvfb-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: c5606a2f67edaae10ef5f9b8c9c929713ae06b081fcf696704bc315414e8ce7a xorg-x11-server-common-1.20.11-21.el9_2.x86_64.rpm SHA-256: 8a3d91d565d890e60520a8375227bbab2f6f4b0f672a87e63213672930397a97 xorg-x11-server-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: 3648754bdc80bf49c675302fb71379e71eaee2f3cdcd69d1d98971b140700a97 xorg-x11-server-debugsource-1.20.11-21.el9_2.x86_64.rpm SHA-256: 368a7c854e9155503e4e0fe5672e7b754a872ac15a24959e917985cc74e4e20d Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 SRPM xorg-x11-server-1.20.11-21.el9_2.src.rpm SHA-256: 915e31b0ee368650c650a1afc60590a8ca2947ccff3a5d499d47d005a31b3cc8 ppc64le xorg-x11-server-Xdmx-1.20.11-21.el9_2.ppc64le.rpm SHA-256: 595f0f17d95fb474f5109f08725e47cb14a183e50922d8803c870727fe4ee8e7 xorg-x11-server-Xdmx-debuginfo-1.20.11-21.el9_2.ppc64le.rpm SHA-256: f9d979f93670de455d5394283a8ae790ffadc6c2eeb9f1bd03bb1b70df5cdbd8 xorg-x11-server-Xephyr-1.20.11-21.el9_2.ppc64le.rpm SHA-256: 0332515f9a62a7e264c53cc0bbb61680bbe88534b4fb36debcc2f2307c73b17c xorg-x11-server-Xephyr-debuginfo-1.20.11-21.el9_2.ppc64le.rpm SHA-256: 50d2d5a1c41435caae5370dcf09e3bc8d3e86de23e685ac9671489412efeb7aa xorg-x11-server-Xnest-1.20.11-21.el9_2.ppc64le.rpm SHA-256: 9a231ae6892bbac71b118cdebb8c7e88b46803b637e5a7d3480f957528b23c9c xorg-x11-server-Xnest-debuginfo-1.20.11-21.el9_2.ppc64le.rpm SHA-256: d6b83045fd573cc6990195ee57e183f12696e131dce95eccfc855b80c1d0956d xorg-x11-server-Xorg-1.20.11-21.el9_2.ppc64le.rpm SHA-256: 087935a020d0522488db9eaea145c665389f3292a00c8b1ff14fa7e283026c5f xorg-x11-server-Xorg-debuginfo-1.20.11-21.el9_2.ppc64le.rpm SHA-256: 7bba758349bd0010b8d3349e7055669048ff8cf7bcbe3e910d4a93d7c34aea1a xorg-x11-server-Xvfb-1.20.11-21.el9_2.ppc64le.rpm SHA-256: b618de0c6acc3d5895e473f6a6170a01570a0702bb115f90f375cafcd4bf207b xorg-x11-server-Xvfb-debuginfo-1.20.11-21.el9_2.ppc64le.rpm SHA-256: 6764d117f4c74f0c81da58824df3e4fb7fd82d25b0e6ddc85c97701bd0ef28d7 xorg-x11-server-common-1.20.11-21.el9_2.ppc64le.rpm SHA-256: 61bba9344ba5a70004371e3088dd0e113388cb5ce2a9fb521cd81e1efa696515 xorg-x11-server-debuginfo-1.20.11-21.el9_2.ppc64le.rpm SHA-256: e50f05236ceada07731da42cba6490a6d0d87c746c7533114e7553180eb84535 xorg-x11-server-debugsource-1.20.11-21.el9_2.ppc64le.rpm SHA-256: 997cc73f1f6a23ddf9ec0e79b9ca5b30a9a311daec7144c8d1e5abf25b5ada0e Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 SRPM xorg-x11-server-1.20.11-21.el9_2.src.rpm SHA-256: 915e31b0ee368650c650a1afc60590a8ca2947ccff3a5d499d47d005a31b3cc8 x86_64 xorg-x11-server-Xdmx-1.20.11-21.el9_2.x86_64.rpm SHA-256: da53bd21fb1716ead558afc33e35d9e56bc1acbd8879fb9cd9bf205a3dff63f3 xorg-x11-server-Xdmx-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: 8efc6d981f8d97631ae20fa2b558c96b323c2c5b42687d4ad267941763698461 xorg-x11-server-Xephyr-1.20.11-21.el9_2.x86_64.rpm SHA-256: 00d5e64cd448ab4e52b7fab21e2d402f57e426d03b1667efa4c4d89440d046c3 xorg-x11-server-Xephyr-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: 8cc3eaa8c62437910dadf582fc0f38e138ffa878617de74a5734d7c7ce3fab82 xorg-x11-server-Xnest-1.20.11-21.el9_2.x86_64.rpm SHA-256: 7197da0b11efe1bd23abbfc54d53e7ceb97602b751da050676956756d47aec6a xorg-x11-server-Xnest-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: 0dedd60cf224c411be7315c42e749cb9d2729734028b719e184e081932a112d5 xorg-x11-server-Xorg-1.20.11-21.el9_2.x86_64.rpm SHA-256: 4e1606bf9ae742f241f549c9e0cf1a2353746232cde3de4fa7112459189bb823 xorg-x11-server-Xorg-debuginfo-1.20.11-21.el9_2.x86_64.rpm SHA-256: 42b2af42e4710381bc7fb72dbc58be035f242a96852abb7e0698ee75e27e4fe6 xorg-x11-server-Xvfb-1.20.11-21.el9_2.x86_64.rpm SHA-256: f45ac0ce5d58d33da12f51b24cc2961b993c1a8ce1b871b1003b99c0235b5bda xorg-x11-server-Xvfb-debuginfo-1.20.11-21.el9_2.x86