This Red Hat security advisory addresses multiple critical memory safety vulnerabilities in Xwayland, including stack buffer overflows and use-after-free conditions, primarily exploitable via malicious X client requests. The CVSS 3.1 base score for several listed CVEs, including CVE-2026-50256, CVE-2026-50257, and CVE-2026-50258, is 7.8 (High). Affected systems include x.org X Server versions prior to 21.1.23 and Xwayland versions prior to 24.1.12, as well as multiple Red Hat Enterprise Linux versions. The fix requires updating the xorg-x11-server-Xwayland package to the patched version provided in the advisory for RHEL 9.6 EUS.
Red Hat Product Errata RHSA-2026:36634 - Security Advisory Issued: 2026-07-08 Updated: 2026-07-08 RHSA-2026:36634 - Security Advisory Overview Updated Packages Synopsis Important: xorg-x11-server-Xwayland security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Xwayland is an X server for running X clients under Wayland. Security Fix(es): xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2485380 - CVE-2026-50256 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch BZ - 2485382 - CVE-2026-50257 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() BZ - 2485383 - CVE-2026-50258 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels BZ - 2485384 - CVE-2026-50259 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing BZ - 2485385 - CVE-2026-50260 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() BZ - 2485386 - CVE-2026-50261 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() BZ - 2485387 - CVE-2026-50262 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes BZ - 2485388 - CVE-2026-50263 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() BZ - 2485389 - CVE-2026-50264 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat CVEs CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.src.rpm SHA-256: 72b0f6d3be5eaaba0d83ed064d3ca1b3e88c5a3aefc8520817177905fdef683d x86_64 xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.x86_64.rpm SHA-256: 83862435fa8fec5543c45315101b10b1b89012691ee56028fcf3d1485437b32d xorg-x11-server-Xwayland-debuginfo-23.2.7-6.el9_6.1.x86_64.rpm SHA-256: 07fa3ebf8e8c027f842722125a48b166b9e7ed6011790e56052d761b5bd3736d xorg-x11-server-Xwayland-debugsource-23.2.7-6.el9_6.1.x86_64.rpm SHA-256: b922e1b59edabd0ce2ba142eeca63dff1e70608c6da6eb3d7bbe6e80c9f7cfb2 Red Hat Enterprise Linux Server - AUS 9.6 SRPM xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.src.rpm SHA-256: 72b0f6d3be5eaaba0d83ed064d3ca1b3e88c5a3aefc8520817177905fdef683d x86_64 xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.x86_64.rpm SHA-256: 83862435fa8fec5543c45315101b10b1b89012691ee56028fcf3d1485437b32d xorg-x11-server-Xwayland-debuginfo-23.2.7-6.el9_6.1.x86_64.rpm SHA-256: 07fa3ebf8e8c027f842722125a48b166b9e7ed6011790e56052d761b5bd3736d xorg-x11-server-Xwayland-debugsource-23.2.7-6.el9_6.1.x86_64.rpm SHA-256: b922e1b59edabd0ce2ba142eeca63dff1e70608c6da6eb3d7bbe6e80c9f7cfb2 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 SRPM xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.src.rpm SHA-256: 72b0f6d3be5eaaba0d83ed064d3ca1b3e88c5a3aefc8520817177905fdef683d s390x xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.s390x.rpm SHA-256: 1e4c65e25e20799270aa476c3ae48b5ddaba9d2a42bf4247bb7526882bd1d5d5 xorg-x11-server-Xwayland-debuginfo-23.2.7-6.el9_6.1.s390x.rpm SHA-256: 51271e4d76c2ba71aef90f888975f07f59bc1fe56ff173f0fbb17c70a672440a xorg-x11-server-Xwayland-debugsource-23.2.7-6.el9_6.1.s390x.rpm SHA-256: 5b74173a52eaf869f1312245c8a61237678efa59af7c1b92851657ddbb3443fa Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 SRPM xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.src.rpm SHA-256: 72b0f6d3be5eaaba0d83ed064d3ca1b3e88c5a3aefc8520817177905fdef683d ppc64le xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.ppc64le.rpm SHA-256: dba33b051986b875687aba8b7c19016a44ed4b8c92481f9d7866522970513951 xorg-x11-server-Xwayland-debuginfo-23.2.7-6.el9_6.1.ppc64le.rpm SHA-256: 212334f9cbecf4081b7fe4fb6b67858e563276ce0048cc17fdfb161bb1a6d57b xorg-x11-server-Xwayland-debugsource-23.2.7-6.el9_6.1.ppc64le.rpm SHA-256: 78458f79e13cbf111fbf8f05630ba479b46b0d100dfaa3383dc07214bd9129f3 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 SRPM xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.src.rpm SHA-256: 72b0f6d3be5eaaba0d83ed064d3ca1b3e88c5a3aefc8520817177905fdef683d aarch64 xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.aarch64.rpm SHA-256: 165f31cf40c708b70f3bb2226d680a450549b5058a7666894dc6251beeddefe0 xorg-x11-server-Xwayland-debuginfo-23.2.7-6.el9_6.1.aarch64.rpm SHA-256: 7b0e68a549175869abce087bd5f2b14b1f4ae548b2ce1361ac64715f50557713 xorg-x11-server-Xwayland-debugsource-23.2.7-6.el9_6.1.aarch64.rpm SHA-256: d7a7eaaaf46c99b240a5fddfafcac8587412bebc1307c70cbff3315072d3aff3 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 SRPM xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.src.rpm SHA-256: 72b0f6d3be5eaaba0d83ed064d3ca1b3e88c5a3aefc8520817177905fdef683d ppc64le xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.ppc64le.rpm SHA-256: dba33b051986b875687aba8b7c19016a44ed4b8c92481f9d7866522970513951 xorg-x11-server-Xwayland-debuginfo-23.2.7-6.el9_6.1.ppc64le.rpm SHA-256: 212334f9cbecf4081b7fe4fb6b67858e563276ce0048cc17fdfb161bb1a6d57b xorg-x11-server-Xwayland-debugsource-23.2.7-6.el9_6.1.ppc64le.rpm SHA-256: 78458f79e13cbf111fbf8f05630ba479b46b0d100dfaa3383dc07214bd9129f3 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 SRPM xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.src.rpm SHA-256: 72b0f6d3be5eaaba0d83ed064d3ca1b3e88c5a3aefc8520817177905fdef683d x86_64 xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.x86_64.rpm SHA-256: 83862435fa8fec5543c45315101b10b1b89012691ee56028fcf3d1485437b32d xorg-x11-server-Xwayland-debuginfo-23.2.7-6.el9_6.1.x86_64.rpm SHA-256: 07fa3ebf8e8c027f842722125a48b166b9e7ed6011790e56052d761b5bd3736d xorg-x11-server-Xwayland-debugsource-23.2.7-6.el9_6.1.x86_64.rpm SHA-256: b922e1b59edabd0ce2ba142eeca63dff1e70608c6da6eb3d7bbe6e80c9f7cfb2 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 SRPM x86_64 xorg-x11-server-Xwayland-23.2.7-6.el9_6.1.i686.rpm SHA-256: 57553a90c54f61708b77a5581e381e1235a7da379c9608bd166f2a934a11802c xorg-x11-server-Xwayland-debuginfo-23.2.7-6.el9_6.1.i686.rpm SHA-256: a11d98e4e1c3f28266c4f1bcd4dccce7ab4374