This security update addresses two high-severity vulnerabilities in Xwayland: a heap buffer overflow in the glamor Font Atlas (CVE-2026-55999, CVSS 8.5) and a use-after-free in GLX contextTags within CommonMakeCurrent() (CVE-2026-56000, CVSS 7.8). The flaws affect X.Org X Server versions prior to 21.2.24 and Xwayland versions prior to 24.1.13. The fix is included in the provided Red Hat packages, and systems should be updated to these patched versions.
Red Hat Product Errata RHSA-2026:52398 - Security Advisory Issued: 2026-08-10 Updated: 2026-08-10 RHSA-2026:52398 - Security Advisory Overview Updated Packages Synopsis Important: xorg-x11-server-Xwayland security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Xwayland is an X server for running X clients under Wayland. Security Fix(es): xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2496165 - CVE-2026-55999 xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow BZ - 2496193 - CVE-2026-56000 X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() CVEs CVE-2026-55999 CVE-2026-56000 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.src.rpm SHA-256: 2a7cb1342a37c9c766a4740e9780667c1c66ac649165349c48aad5a20c4e9fd3 x86_64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.x86_64.rpm SHA-256: dbc84ad85cd5b2d63ed734a47a6f5a8725505fb882bb7d370d4614f95341a223 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.3.x86_64.rpm SHA-256: 4cec3e8e92f5a3088bbe255d0b18d51a28fd6fb1b9219a85375fbbb75a5c2120 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.3.x86_64.rpm SHA-256: 99a59bc676d2c356b7e4c10bbeb03d68060b96100f6db81ab492684ff3c2a5ef Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.src.rpm SHA-256: 2a7cb1342a37c9c766a4740e9780667c1c66ac649165349c48aad5a20c4e9fd3 ppc64le xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.ppc64le.rpm SHA-256: f512a3b6fbf76603cdb796ee1784895ffe02e5c6ab43421f1c55b2e8f478eafc xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.3.ppc64le.rpm SHA-256: 3d6a110650e7972eef47dc459932fdd75e6b26eb822392ba898ef77bf5783b02 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.3.ppc64le.rpm SHA-256: 2abfbec168a512ec6c115702a3fab1348f0bbd5293d98964700396cacbc3d8d2 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.src.rpm SHA-256: 2a7cb1342a37c9c766a4740e9780667c1c66ac649165349c48aad5a20c4e9fd3 x86_64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.x86_64.rpm SHA-256: dbc84ad85cd5b2d63ed734a47a6f5a8725505fb882bb7d370d4614f95341a223 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.3.x86_64.rpm SHA-256: 4cec3e8e92f5a3088bbe255d0b18d51a28fd6fb1b9219a85375fbbb75a5c2120 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.3.x86_64.rpm SHA-256: 99a59bc676d2c356b7e4c10bbeb03d68060b96100f6db81ab492684ff3c2a5ef Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.src.rpm SHA-256: 2a7cb1342a37c9c766a4740e9780667c1c66ac649165349c48aad5a20c4e9fd3 aarch64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.aarch64.rpm SHA-256: c47664966c610c34a1f588ae2cc9dd70769a225ed7ac33ba7b2430f65d4fa98b xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.3.aarch64.rpm SHA-256: 6e48c332ede0d81e3de53f90cc33477cb1a13dc1b6152fcd262242fbc542704c xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.3.aarch64.rpm SHA-256: ee54c666a4fbd31fa74293ed1f4e2137bccb6d6a4818460600cb675e5903cdd3 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.src.rpm SHA-256: 2a7cb1342a37c9c766a4740e9780667c1c66ac649165349c48aad5a20c4e9fd3 s390x xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.s390x.rpm SHA-256: 7bad074c24995603c9336a16496e15d7a5e73c8802243d31bcc9d0fdece8cdc1 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.3.s390x.rpm SHA-256: ee163e3c04431b1c63743051db26b6ebee9c0f353fd01cfee7c2f9a79f7a0e0d xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.3.s390x.rpm SHA-256: addbe71a8716c454ac0235711ac2ab7d7627aae0229b92c5e263b391fe7478ec Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.src.rpm SHA-256: 2a7cb1342a37c9c766a4740e9780667c1c66ac649165349c48aad5a20c4e9fd3 x86_64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.x86_64.rpm SHA-256: dbc84ad85cd5b2d63ed734a47a6f5a8725505fb882bb7d370d4614f95341a223 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.3.x86_64.rpm SHA-256: 4cec3e8e92f5a3088bbe255d0b18d51a28fd6fb1b9219a85375fbbb75a5c2120 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.3.x86_64.rpm SHA-256: 99a59bc676d2c356b7e4c10bbeb03d68060b96100f6db81ab492684ff3c2a5ef Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.src.rpm SHA-256: 2a7cb1342a37c9c766a4740e9780667c1c66ac649165349c48aad5a20c4e9fd3 aarch64 xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.aarch64.rpm SHA-256: c47664966c610c34a1f588ae2cc9dd70769a225ed7ac33ba7b2430f65d4fa98b xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.3.aarch64.rpm SHA-256: 6e48c332ede0d81e3de53f90cc33477cb1a13dc1b6152fcd262242fbc542704c xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.3.aarch64.rpm SHA-256: ee54c666a4fbd31fa74293ed1f4e2137bccb6d6a4818460600cb675e5903cdd3 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.src.rpm SHA-256: 2a7cb1342a37c9c766a4740e9780667c1c66ac649165349c48aad5a20c4e9fd3 ppc64le xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.ppc64le.rpm SHA-256: f512a3b6fbf76603cdb796ee1784895ffe02e5c6ab43421f1c55b2e8f478eafc xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.3.ppc64le.rpm SHA-256: 3d6a110650e7972eef47dc459932fdd75e6b26eb822392ba898ef77bf5783b02 xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.3.ppc64le.rpm SHA-256: 2abfbec168a512ec6c115702a3fab1348f0bbd5293d98964700396cacbc3d8d2 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 SRPM xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.src.rpm SHA-256: 2a7cb1342a37c9c766a4740e9780667c1c66ac649165349c48aad5a20c4e9fd3 s390x xorg-x11-server-Xwayland-22.1.9-8.el9_4.3.s390x.rpm SHA-256: 7bad074c24995603c9336a16496e15d7a5e73c8802243d31bcc9d0fdece8cdc1 xorg-x11-server-Xwayland-debuginfo-22.1.9-8.el9_4.3.s390x.rpm SHA-256: ee163e3c04431b1c63743051db26b6ebee9c0f353fd01cfee7c2f9a79f7a0e0d xorg-x11-server-Xwayland-debugsource-22.1.9-8.el9_4.3.s390x.rpm SHA-256: addbe71a8716c454ac0235711ac2ab7d7627aae0229b92c5e263b391fe7478ec The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .