An Important security update for xorg-x11-server-Xwayland addresses two high-severity vulnerabilities: a heap buffer overflow in the glamor Font Atlas (CVE-2026-55999, CVSS 8.5) and a use-after-free in GLX contextTags within CommonMakeCurrent() (CVE-2026-56000, CVSS 7.8). The flaws affect X.Org X Server versions prior to 21.2.24 and XWayland versions prior to 24.1.13. The fix is included in the updated packages provided by Red Hat for RHEL 10.
Red Hat Product Errata RHSA-2026:38489 - Security Advisory Issued: 2026-07-13 Updated: 2026-07-13 RHSA-2026:38489 - Security Advisory Overview Updated Packages Synopsis Important: xorg-x11-server-Xwayland security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Xwayland is an X server for running X clients under Wayland. Security Fix(es): xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat CodeReady Linux Builder for x86_64 10 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le Red Hat CodeReady Linux Builder for ARM 64 10 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2496165 - CVE-2026-55999 xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow BZ - 2496193 - CVE-2026-56000 X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() CVEs CVE-2026-55999 CVE-2026-56000 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.src.rpm SHA-256: 6823f53c184eb64453a5148f0db72a17df09924e4052e5eac59561dde6589726 x86_64 xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.x86_64.rpm SHA-256: 4a9287ec559d491dc57a53a2f272c9e683cb77ff611568b9b69c7564a31a6382 xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.x86_64.rpm SHA-256: b9eb130708e114c09fedd8166e0fab1bba5a798b62e39bfd573cdb860bbe3e2b xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.x86_64.rpm SHA-256: 1675534b1eca79d95044a1567362c6e5c4ef1178049b4d61f5b66df118d02c8a Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.src.rpm SHA-256: 6823f53c184eb64453a5148f0db72a17df09924e4052e5eac59561dde6589726 x86_64 xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.x86_64.rpm SHA-256: 4a9287ec559d491dc57a53a2f272c9e683cb77ff611568b9b69c7564a31a6382 xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.x86_64.rpm SHA-256: b9eb130708e114c09fedd8166e0fab1bba5a798b62e39bfd573cdb860bbe3e2b xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.x86_64.rpm SHA-256: 1675534b1eca79d95044a1567362c6e5c4ef1178049b4d61f5b66df118d02c8a Red Hat Enterprise Linux for IBM z Systems 10 SRPM xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.src.rpm SHA-256: 6823f53c184eb64453a5148f0db72a17df09924e4052e5eac59561dde6589726 s390x xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.s390x.rpm SHA-256: 722c690aae3cda103aa1a47665f73556788131ab17dd87a36449f67d9b2bf853 xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.s390x.rpm SHA-256: 2859db4228c0f5afe61d05e5fd4d4255ef2090d679855fd911313ab84a44640b xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.s390x.rpm SHA-256: 40419e86b477d2900e89fad08e46b71ad73d4122080401351add3cae3d9a1eb3 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.src.rpm SHA-256: 6823f53c184eb64453a5148f0db72a17df09924e4052e5eac59561dde6589726 s390x xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.s390x.rpm SHA-256: 722c690aae3cda103aa1a47665f73556788131ab17dd87a36449f67d9b2bf853 xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.s390x.rpm SHA-256: 2859db4228c0f5afe61d05e5fd4d4255ef2090d679855fd911313ab84a44640b xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.s390x.rpm SHA-256: 40419e86b477d2900e89fad08e46b71ad73d4122080401351add3cae3d9a1eb3 Red Hat Enterprise Linux for Power, little endian 10 SRPM xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.src.rpm SHA-256: 6823f53c184eb64453a5148f0db72a17df09924e4052e5eac59561dde6589726 ppc64le xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.ppc64le.rpm SHA-256: 7137011bbfeda6d0b3dd6f4bf269314b04ebb61fdf75e8c13e598299137cecaf xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.ppc64le.rpm SHA-256: 47bed079ac7f5937ba6e2c498bac968c5ee0333a94602d600dd4350222549d10 xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.ppc64le.rpm SHA-256: 648b920b22b5809f3337ad84833db4e2c352d942620db032d5a4345b04ba9b44 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.src.rpm SHA-256: 6823f53c184eb64453a5148f0db72a17df09924e4052e5eac59561dde6589726 ppc64le xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.ppc64le.rpm SHA-256: 7137011bbfeda6d0b3dd6f4bf269314b04ebb61fdf75e8c13e598299137cecaf xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.ppc64le.rpm SHA-256: 47bed079ac7f5937ba6e2c498bac968c5ee0333a94602d600dd4350222549d10 xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.ppc64le.rpm SHA-256: 648b920b22b5809f3337ad84833db4e2c352d942620db032d5a4345b04ba9b44 Red Hat Enterprise Linux for ARM 64 10 SRPM xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.src.rpm SHA-256: 6823f53c184eb64453a5148f0db72a17df09924e4052e5eac59561dde6589726 aarch64 xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.aarch64.rpm SHA-256: da773dd3abb7e42e3d2205bc96e901ce0871984a774c5f1de3805d4844790c70 xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.aarch64.rpm SHA-256: 71a30e912a99b759dffb74daa35521789504bc44d968bd92a2bbd21010674aea xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.aarch64.rpm SHA-256: 051f163d79e6da0959fa86e646514ad46028bfb70d6d3b599c7276bfe6414028 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 SRPM xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.src.rpm SHA-256: 6823f53c184eb64453a5148f0db72a17df09924e4052e5eac59561dde6589726 aarch64 xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.aarch64.rpm SHA-256: da773dd3abb7e42e3d2205bc96e901ce0871984a774c5f1de3805d4844790c70 xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.aarch64.rpm SHA-256: 71a30e912a99b759dffb74daa35521789504bc44d968bd92a2bbd21010674aea xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.aarch64.rpm SHA-256: 051f163d79e6da0959fa86e646514ad46028bfb70d6d3b599c7276bfe6414028 Red Hat CodeReady Linux Builder for x86_64 10 SRPM x86_64 xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.x86_64.rpm SHA-256: b9eb130708e114c09fedd8166e0fab1bba5a798b62e39bfd573cdb860bbe3e2b xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.x86_64.rpm SHA-256: 1675534b1eca79d95044a1567362c6e5c4ef1178049b4d61f5b66df118d02c8a xorg-x11-server-Xwayland-devel-24.1.9-4.el10_2.3.x86_64.rpm SHA-256: 7c944adbaefe5aee2dc2256f739546bc8ea2fb35ca8aa5c151a7ed6c4c37d82e Red Hat CodeReady Linux Builder for Power, little endian 10 SRPM ppc64le xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.ppc64le.rpm SHA-256: 47bed079ac7f5937ba6e2c498bac968c5ee0333a94602d600dd4350222549d10 xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.ppc64le.rpm SHA-256: 648b920b22b5809f3337ad84833db4e2c352d942620db032d5a4345b04ba9b44 xorg-x11-server-Xwayland-devel-24.1.9-4.el10_2.3.ppc64le.rpm SHA-256: 5fe9496f3801f2a9d0034e5e9b56299a57c169ecb48ada4c2e9ed0029d9f2fb4 Red Hat CodeReady Linux Builder for ARM 64 10 SRPM aarch64 xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.aarch64.rpm SHA-256: 71a30e912a99b759dffb74daa35521789504bc44d968bd92a2bbd21010674aea xorg-x11-server-Xwayland-debugsource-24.1.9-4.el10_2.3.aarch64.rpm SHA-256: 051f163d79e6da0959fa86e646514ad46028bfb70d6d3b599c7276bfe6414028 xorg-x11-server-Xwayland-devel-24.1.9-4.el10_2.3.aarch64.rpm SHA-256: 4d41dc0b76d983a6f8cfebd98ab1f53354d6fe60d96eda5cc48da40312bb15ac Red Hat CodeReady Linux Builder for IBM z Systems 10 SRPM s390x xorg-x11-server-Xwayland-debuginfo-24.1.9-4.el10_2.3.s390x.rpm SHA-256: 2859db4228c0f5afe61d05e5fd4d4255ef2090d679855fd911313ab84a44640b xorg-x11-server-Xwayland-debugsource-24.1.9