This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-July/003716.html
- CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow
- CVE-2026-56000: GLX contextTags Use-After-Free in CommonMakeCurrent()
As noted in the security advisory, CVE-2026-56000 seems to depend on a
commit not previously in a 21.1.x release (but is present in this
release). As far as we can tell, 21.1.23 and earlier are not vulnerable
to CVE-2026-56000.
On top of those we have few cleanup fixes backported to the 21.1 releases.
Doğukan Korkmaztürk (1):
GLX: Free the tag of the old context later
Jeremy Huddleston Sequoia (2):
xquartz/GL: silence OpenGL deprecation warnings
xquartz/GL: advertise GLX_ARB_create_context and _profile
Mikhail Dmitrichenko (1):
xkb: preserve buffer on realloc failure
Olivier Fourdan (4):
dix: Silence a compiler warning in doListFontsAndAliases()
dix: Silent static analyzer warning
dix: Silence a compiler warning in doListFontsWithInfo()
Xi: Check window attribute is valid in XIChangeCursor
Peter Hutterer (7):
dix/colormap: fix out-of-bounds read in FindColorInRootCmap
glx: fix duplicate tagInfo->vendor = NULL assignment
glamor: fix an error path cleanup
glx: free old context tag before allocating new one in CommonMakeCurrent
fb/mi/glamor: reject glyphs with negative dimensions
glamor: reject fonts with per-glyph metrics exceeding maxbounds
xserver 21.1.24
git tag: xorg-server-21.1.24
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.24.tar.gz
SHA256: d01ccd7ba48ec9d6815aeef5fb408d0c307ab6be21d20ff0b54b11f1c2b8a075
xorg-server-21.1.24.tar.gz
SHA512:
e4f0fc989e7c113c0839ce1dd84a417d4d47332cdda06dac57db10355fdb0182dd41f87e8fdcda527c278d8efe092d22b57bc5de020f732b6d6c905153822c0b
xorg-server-21.1.24.tar.gz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.24.tar.gz.sig
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.24.tar.xz
SHA256: 1a4eb36ca65cc3b1b936566d677a9786e13c11cd5806e951ac55f3f5ce3984af
xorg-server-21.1.24.tar.xz
SHA512:
f51372b04fe21632fc778ff240705161ed2dccc0114dbe3ee25156d8ac85ec945e2ac05d8638bc7d8d54bad4dfc89cb26b6bd2058b7804d54ab7179e1ac2eb13
xorg-server-21.1.24.tar.xz
PGP:
https://xorg.freedesktop.org/archive/individual/xserver/xorg-server-21.1.24.tar.xz.sig
signature.asc
Description: PGP signature
