This security update addresses multiple critical vulnerabilities in Xwayland, including stack buffer overflows and use-after-free conditions, which could lead to privilege escalation or information disclosure. The CVSS 3.1 base score for these flaws is 7.8 (High). Affected versions include xorg-x11-server-Xwayland prior to versions 21.1.23 and 24.1.12, specifically impacting Red Hat Enterprise Linux versions 7.0, 8.0, and 9.0. The fix is to apply the Red Hat update, which patches these CVEs.
Red Hat Product Errata RHSA-2026:36632 - Security Advisory Issued: 2026-07-08 Updated: 2026-07-08 RHSA-2026:36632 - Security Advisory Overview Updated Packages Synopsis Important: xorg-x11-server-Xwayland security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Xwayland is an X server for running X clients under Wayland. Security Fix(es): xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2485380 - CVE-2026-50256 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch BZ - 2485382 - CVE-2026-50257 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() BZ - 2485383 - CVE-2026-50258 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels BZ - 2485384 - CVE-2026-50259 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing BZ - 2485385 - CVE-2026-50260 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() BZ - 2485386 - CVE-2026-50261 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() BZ - 2485387 - CVE-2026-50262 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes BZ - 2485388 - CVE-2026-50263 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() BZ - 2485389 - CVE-2026-50264 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat CVEs CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.src.rpm SHA-256: c2685e63e9ae24a40d8b41ece7bbf150f519f52c3d61f46886b6af685789c7bb x86_64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.x86_64.rpm SHA-256: 10007926269dd0f42fe1fe30165896b80a76728029b109a556c02609a3aa9792 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.1.x86_64.rpm SHA-256: 4a4a27f4b87eaa00c57123937ceb5d0c3eaad32870824d06cab77b115309ef04 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.1.x86_64.rpm SHA-256: 53ad85f07e75edff174daf46f1fe26d40faccdb26b7c98e761d2f40050ef9d7c Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.src.rpm SHA-256: c2685e63e9ae24a40d8b41ece7bbf150f519f52c3d61f46886b6af685789c7bb ppc64le xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.ppc64le.rpm SHA-256: 670ea9384c96e02019822e703e04c90f9a6c1f5038bd286e973caa222bff4fc6 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.1.ppc64le.rpm SHA-256: 86cbc1a7176f8586693a1f273d9d66d0efcb5060141bc7b08e98850279c953b1 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.1.ppc64le.rpm SHA-256: c0b064638eda8c7070b48187aa3895f282c1fc35e7abd4eb3c908b11f27cbc09 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.src.rpm SHA-256: c2685e63e9ae24a40d8b41ece7bbf150f519f52c3d61f46886b6af685789c7bb x86_64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.x86_64.rpm SHA-256: 10007926269dd0f42fe1fe30165896b80a76728029b109a556c02609a3aa9792 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.1.x86_64.rpm SHA-256: 4a4a27f4b87eaa00c57123937ceb5d0c3eaad32870824d06cab77b115309ef04 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.1.x86_64.rpm SHA-256: 53ad85f07e75edff174daf46f1fe26d40faccdb26b7c98e761d2f40050ef9d7c Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.src.rpm SHA-256: c2685e63e9ae24a40d8b41ece7bbf150f519f52c3d61f46886b6af685789c7bb aarch64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.aarch64.rpm SHA-256: 5ff30043000368c3bd3b1adf7ed7be0150ebc9e0f3d5e8aae374e38dd11e9e6e xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.1.aarch64.rpm SHA-256: df57c6b89a772ec24b206a3e118c3d2a5ad675217a17887a4608631beb2c74e4 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.1.aarch64.rpm SHA-256: 672dad413cf2fc936b0f4f67ee054dba168ef9a7fd5b284ce37a21ef11bea447 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.src.rpm SHA-256: c2685e63e9ae24a40d8b41ece7bbf150f519f52c3d61f46886b6af685789c7bb s390x xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.s390x.rpm SHA-256: da292a942e6e64e49a57b075354e6f99d63015b087f16ffd9d4b7722f5d6e7d1 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.1.s390x.rpm SHA-256: 78f46db10c997801d2a7d70e1f481d222cfc4c63e4de2b2bd6781ef4f96a5b07 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.1.s390x.rpm SHA-256: 83c2ac656d316bffcc4ba884a8e9a5e6eaff7431eb5ceb9d3789a5c2202e4b7d Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.src.rpm SHA-256: c2685e63e9ae24a40d8b41ece7bbf150f519f52c3d61f46886b6af685789c7bb x86_64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.x86_64.rpm SHA-256: 10007926269dd0f42fe1fe30165896b80a76728029b109a556c02609a3aa9792 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.1.x86_64.rpm SHA-256: 4a4a27f4b87eaa00c57123937ceb5d0c3eaad32870824d06cab77b115309ef04 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.1.x86_64.rpm SHA-256: 53ad85f07e75edff174daf46f1fe26d40faccdb26b7c98e761d2f40050ef9d7c Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.src.rpm SHA-256: c2685e63e9ae24a40d8b41ece7bbf150f519f52c3d61f46886b6af685789c7bb aarch64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.aarch64.rpm SHA-256: 5ff30043000368c3bd3b1adf7ed7be0150ebc9e0f3d5e8aae374e38dd11e9e6e xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.1.aarch64.rpm SHA-256: df57c6b89a772ec24b206a3e118c3d2a5ad675217a17887a4608631beb2c74e4 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.1.aarch64.rpm SHA-256: 672dad413cf2fc936b0f4f67ee054dba168ef9a7fd5b284ce37a21ef11bea447 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.src.rpm SHA-256: c2685e63e9ae24a40d8b41ece7bbf150f519f52c3d61f46886b6af685789c7bb ppc64le xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.ppc64le.rpm SHA-256: 670ea9384c96e02019822e703e04c90f9a6c1f5038bd286e973caa222bff4fc6 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.1.ppc64le.rpm SHA-256: 86cbc1a7176f8586693a1f273d9d66d0efcb5060141bc7b08e98850279c953b1 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.1.ppc64le.rpm SHA-256: c0b064638eda8c7070b48187aa3895f282c1fc35e7abd4eb3c908b11f27cbc09 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.src.rpm SHA-256: c2685e63e9ae24a40d8b41ece7bbf150f519f52c3d61f46886b6af685789c7bb s390x xorg-x11-server-Xwayland-22.1.9-8.el9_4.1.s390x.rpm SHA-256: da292a942e6e64e49a57b075354e6f99d63015b087f16ffd9d4b7722f5d6e7d1 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9