This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-April/003677.html
* CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap()
* CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom()
* CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence()
* CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap()
* CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes()
Additionally, it contains a number of other various fixes from the stable
xserver-21.1-branch:
Alan Coopersmith (17):
Create a SECURITY.md file
Makefile.am: add SECURITY.md to EXTRA_DIST
xfree86: Fix builds with gcc -Wpedantic
dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs()
os: include <assert.h> in ospoll.c
os: make FormatInt64() handle LONG_MIN correctly
xf86bigfont: fix -Wimplicit-function-declaration error
dix: Fix builds with meson -Dxace=false -Dwerror=true
meson: don't build xselinux if xace is disabled
glamor: handle potential NULL return from GetPictureScreenIfSet()
glamor: handle allocation failure in glamor_create_pixmap()
glamor: silence false positive in glamor_validate_gc()
glamor: handle allocation failures in glamor_largepixmap.c
glamor: avoid null dereference in glamor_dash_setup()
glamor: avoid null dereference in glamor_composite_clipped_region()
glamor: avoid double free in glamor_make_pixmap_exportable()
os: fix sha1 build error with Nettle 4.0
Alexander Melnyk (1):
xkb: Fix locked/latched indicator desync across multiple keyboards
Benjamin Valentin (1):
xf86: check return value of XF86_CRTC_CONFIG_PTR in xf86CompatOutput()
Jeremy Huddleston Sequoia (4):
rootless: Fix Glyphs damage bounding box to correctly compute union
rootless: Add Trapezoids, Triangles, and CompositeRects wrapping
rootless: Protect alpha channel for Render operations
xquartz: Bump copyrights in Info.plist to 2026
Matthieu Herrb (1):
Better fix for xf86CompatOut() when there are no privates
Mikhail Dmitrichenko (3):
os: avoid closing null fd at Fopen
render: fix multiple mem leaks on err paths
dix: avoid null ptr deref at doListFontsAndAliases
Olivier Fourdan (6):
xkb: Fix bounds check in _CheckSetGeom()
miext/sync: Fix use-after-free in miSyncTriggerFence()
xkb: Fix out-of-bounds read in CheckModifierMap()
xkb: Add additional bound checking in CheckKeyTypes()
xkb: Add more _XkbCheckRequestBounds()
xserver 21.1.22
Peter Harris (1):
xkb: fix buffer re-use in _XkbSetCompatMap
Pierre Le Marre (2):
xkb: Fix key type without level names in XkbCopyKeymap
xkb: Fix serialization of key type without level names
Takashi Yano (1):
Fix mach64 driver crash
Twaik Yont (1):
os: use close-on-exec for X server socket to prevent fd leaks
hongao (1):
randr: clear primary screen's primaryOutput when the output is deleted
quantenzitrone (2):
COPYING: add missing paragraph to SGI-B-2.0
COPYING: add author to HPND-sell-MIT-disclaimer-xserver
git tag: xorg-server-21.1.22
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.22.tar.gz
SHA256: f8e4f677b313642d9e175b7c69a8aa5453b85636166407232e8b55870c700fa0
xorg-server-21.1.22.tar.gz
SHA512:
f3883c4ac50d4aa20975a66ebfb12aae99bf5dceaca221bdcedacce9387bc1efb0f1f96f3bb25d9890b858ff56449b95b41ec7af4b8292ca159404777696af04
xorg-server-21.1.22.tar.gz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.22.tar.gz.sig
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.22.tar.xz
SHA256: 1a242c8917c49ba29ccc1f6021613d8a2b9805dd0d271a66ae9d09f4b0bb06b3
xorg-server-21.1.22.tar.xz
SHA512:
6cb37ff971e10eb4a7dfcb3e8071afd769c7632d50e4ad8bc948b810dc4847e152b8a05ec135f55e0695b35908abd07e7728ef85dd3135456fd532e919f440f4
xorg-server-21.1.22.tar.xz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.22.tar.xz.sig
OpenPGP_0x14706DBE1E4B4540.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
