This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-April/003677.html
* CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap()
* CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom()
* CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence()
* CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap()
* CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes()
Additionally, it contains a number of other various fixes from the stable
xwayland-24.1 branch:
Alan Coopersmith (18):
xf86bigfont: fix -Wimplicit-function-declaration error
dix: Fix builds with meson -Dxace=false -Dwerror=true
meson: don't build xselinux if xace is disabled
xwayland: fix builds with xace disabled
panoramix: avoid null dereference in PanoramiXMaybeAddDepth()
panoramix: avoid null dereference in PanoramiXConsolidate()
glamor: handle potential NULL return from GetPictureScreenIfSet()
glamor: handle allocation failure in glamor_create_pixmap()
glamor: silence false positive in glamor_validate_gc()
glamor: handle allocation failures in glamor_largepixmap.c
glamor: avoid null dereference in glamor_dash_setup()
glamor: avoid null dereference in glamor_composite_clipped_region()
glamor: avoid double free in glamor_make_pixmap_exportable()
Create a SECURITY.md file
dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs()
os: make FormatInt64() handle LONG_MIN correctly
os: fix sha1 build error with Nettle 4.0
os: include <assert.h> in ospoll.c
Alexander Melnyk (1):
xkb: Fix locked/latched indicator desync across multiple keyboards
Liu Heng (2):
xwayland: Fix incorrect pointer coordinates in enter events
xwayland: prevent X11 get enter event when pointer is over Wayland client
Michel Dänzer (3):
xwayland: Update surface window from xwl_unrealize_window
xwayland: Use WindowPtr for damage closure again
Revert "xwayland: Call register_damage depending on
ensure_surface_for_window"
Mikhail Dmitrichenko (3):
os: avoid closing null fd at Fopen
render: fix multiple mem leaks on err paths
dix: avoid null ptr deref at doListFontsAndAliases
Olivier Fourdan (9):
xwayland: Do not pretend leaving the X11 surface if buttons are down
xwayland: Expunge the SECURITY.md file
xwayland: Use viewport scale for warping coordinates
xkb: Fix bounds check in _CheckSetGeom()
miext/sync: Fix use-after-free in miSyncTriggerFence()
xkb: Fix out-of-bounds read in CheckModifierMap()
xkb: Add additional bound checking in CheckKeyTypes()
xkb: Add more _XkbCheckRequestBounds()
Bump version to 24.1.10
Peter Harris (1):
xkb: fix buffer re-use in _XkbSetCompatMap
Pierre Le Marre (2):
xkb: Fix key type without level names in XkbCopyKeymap
xkb: Fix serialization of key type without level names
Twaik Yont (1):
os: use close-on-exec for X server socket to prevent fd leaks
Yixue Wang (1):
xwayland: wrong expecting_event
hongao (1):
randr: clear primary screen's primaryOutput when the output is deleted
quantenzitrone (2):
COPYING: add missing paragraph to SGI-B-2.0
COPYING: add author to HPND-sell-MIT-disclaimer-xserver
git tag: xwayland-24.1.10
https://xorg.freedesktop.org/archive/individual/xserver/xwayland-24.1.10.tar.xz
SHA256: 459762be8ea046c94386687d77a87add6073868bee14f02913eafebb945b7aa0
xwayland-24.1.10.tar.xz
SHA512:
bceba1db7f4d7ac92d2b2a3c8f6f7ab0cc093f396fe89406f8dba25e32ffc3edfa552df246cbfb3b0708c1d28b3e179694d11870b063d5b8f9ab2db9fb861a8f
xwayland-24.1.10.tar.xz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xwayland-24.1.10.tar.xz.sig
OpenPGP_0x14706DBE1E4B4540.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
