X.Org has released a new security advisory addressing eight vulnerabilities affecting the X.Org X server and Xwayland, two important components of the Linux desktop graphics environment. Published on November 10, 2026, the advisory confirms that the issues have been fixed in xorg-server 21.1.26 and Xwayland 24.1.15.
The vulnerabilities include out-of-bounds memory writes, integer overflows, improper memory access and insufficient validation of image data. Depending on the affected component, these weaknesses could allow specially crafted inputs to crash the graphics server, corrupt memory or cause unintended memory reads.
The fixes are relevant to Linux PC gamers because Xwayland provides compatibility for X11 applications running under Wayland-based desktop environments. Even users who have moved away from traditional X11 sessions may still rely on Xwayland when running certain games and other applications.
One of the vulnerabilities, CVE-2026-109091, affects how the X.Org server processes Extended Display Identification Data (EDID), which monitors use to communicate their supported display modes and refresh rates. According to the official advisory, a malicious monitor or specially crafted EDID data could supply excessive display-range descriptors, causing an out-of-bounds write that may crash the server or corrupt adjacent memory.
Another issue, CVE-2026-109092, involves the XvShmPutImage function, which handles image data through shared memory. A negative image-size calculation combined with a manipulated memory offset could bypass the existing bounds check, allowing the server to access memory outside the intended region.
CVE-2026-109093 affects the XTestFakeInput function, which processes simulated input events. The vulnerability occurs because certain valuator data can be copied into a fixed-size stack array before its boundaries are properly checked. Excessive input data could consequently overwrite stack memory and potentially crash the graphics server.
Two additional vulnerabilities, CVE-2026-109904 and CVE-2026-109094, affect the XRes extension. Both involve integer overflows during request-size calculations on 32-bit servers, potentially allowing malformed requests to bypass validation and trigger unintended memory access. The first issue could also expose memory contents under certain conditions.
The remaining three vulnerabilities concern image handling and size validation. CVE-2026-109095 affects calculations for NV12 and YV12 image formats in the glamor acceleration code, where integer overflow can result in out-of-bounds reads. CVE-2026-109096 allows certain negative image-size values to bypass request-length checks, while CVE-2026-109903 can return an invalid image-data size to clients, potentially causing incorrect buffer allocations.
X.Org’s advisory identifies the following eight vulnerabilities as addressed by the new releases: CVE-2026-109091, CVE-2026-109092, CVE-2026-109093, CVE-2026-109094, CVE-2026-109095, CVE-2026-109096, CVE-2026-109903 and CVE-2026-109904.
All eight issues are listed as affecting versions earlier than xorg-server 21.1.26 and Xwayland 24.1.15. The advisory documents the underlying vulnerabilities and their fixes but does not establish that they have been actively exploited in the wild.
For Linux gaming desktops, the practical recommendation is to install updated graphics-server packages as they become available through the operating system’s package repositories. Users running X11 sessions should check their xorg-server package, while those using Wayland should also verify their installed Xwayland version.
Linux distributions may distribute security fixes through backported patches without adopting the exact upstream version numbers, so users should consult their distribution’s security announcements when determining whether their systems are protected.
The advisory arrives as Linux distributions continue updating their desktop graphics stacks. Recent releases such as Fedora Linux 45 with GNOME 51 and KDE Plasma 6.8 highlight the ongoing development of Wayland-based desktops, where compatibility with existing X11 applications remains important.
The November 10 advisory provides fixes for both the traditional X.Org server and Xwayland, allowing distributions to address the disclosed vulnerabilities across both graphics environments.
