CLSA-2026-1782484404
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1782484404.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1782484404
- Upstream
- Published
- 2026-06-26T14:33:49Z
- Modified
- 2026-10-26T09:30:23Z
- Summary
- xorg-x11-server-Xwayland: Fix of 8 CVEs
- Details
-
- CVE-2026-50256: increase XLFDMAXFONTNAMELEN and add bounds checks in doListFontsAndAliases/doListFontsWithInfo to prevent stack buffer overflow via long fonts.alias targets
- CVE-2026-50257: fix use-after-free in miSyncDestroyFence by using safe list iteration and null-checking pTrigger before dereferencing
- CVE-2026-50258: reject XkbSetMap key types with numLevels exceeding XkbMaxShiftLevel to prevent stack buffer overflow in XkbKeyTypesForCoreSymbols
- CVE-2026-50259: clamp nMaps to XkbMaxLegalKeyCode+1 in CheckKeyTypes to prevent stack buffer overflow when XkbSetMapResizeTypes wraps
- CVE-2026-50260: fix use-after-free in FreeCounter by using safe list iteration, advancing list head before callback, and NULL-ing out shared trigger pointers in FreeAwait
- CVE-2026-50261: restart trigger list iteration in SyncChangeCounter after TriggerFired to avoid dereferencing freed sibling-trigger nodes
- CVE-2026-50262: fix reversed length check in GLX ChangeDrawableAttributes by using REQUEST_FIXED_SIZE to prevent out-of-bounds read/write
- CVE-2026-50263: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow to avoid use-after-free on saver-window replacement
- References
-
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782484404.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-50256
- https://nvd.nist.gov/vuln/detail/CVE-2026-50257
- https://nvd.nist.gov/vuln/detail/CVE-2026-50258
- https://nvd.nist.gov/vuln/detail/CVE-2026-50259
- https://nvd.nist.gov/vuln/detail/CVE-2026-50260
- https://nvd.nist.gov/vuln/detail/CVE-2026-50261
- https://nvd.nist.gov/vuln/detail/CVE-2026-50262
- https://nvd.nist.gov/vuln/detail/CVE-2026-50263
Affected packages
TuxCare:AlmaLinux:9.2 / xorg-x11-server-Xwayland
Package
- Name
- xorg-x11-server-Xwayland
- Purl
- pkg:rpm/tuxcare/xorg-x11-server-Xwayland?distro=almalinux-9.2