CVE-2026-93522: 
Rocky Linux 脆弱性分析と緩和策

CVE-2026-93522 is a heap-based buffer overflow vulnerability in the Glamor acceleration layer of the X.Org X Server and XWayland, specifically in the CopyArea CPU-to-FBO (Framebuffer Object) path. It affects X.Org X Server before version 21.1.15 (RPM packages before 21.1.25) and XWayland before version 24.1.14. The vulnerability was disclosed on October 7, 2026, and has a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause (CWE-122: Heap-based Buffer Overflow) lies in the glamor_upload_boxes() function, which allocates the tmp_bits buffer — used for 24-bit to 32-bit depth conversion — based on the destination pixmap height, but indexes it using source coordinates (y1 - dy_dst + dy_src). When the source pixmap is taller than the destination, the source-relative offset exceeds the allocated buffer size, causing out-of-bounds writes past the buffer end. Exploitation requires a locally authenticated X client to send a crafted CopyArea request where the source region is larger than the destination, triggering the overflow. The vulnerability was discovered by an anonymous researcher working with Trend Micro's Zero Day Initiative (ZDI-CAN-32361) (Red Hat Bugzilla).

Successful exploitation allows an authenticated local X client to crash the X server (denial of service) or potentially execute arbitrary code within the X server's privilege context. Because the X server often runs with elevated privileges on Linux desktop systems, code execution could lead to privilege escalation, full system compromise, and access to sensitive data processed by the display server. The scope is limited to the local system, but lateral movement within a multi-user environment is possible if the X server is shared (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The vulnerability requires local authentication (a valid X client session), which limits the attack surface compared to remote vulnerabilities. The EPSS score is approximately 0.202%, indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (IDs: 364284, 364336, 367281, 367377, 367397, 367723, 371914) and Qualys (IDs: 765889, 6601011, 6601001) (Red Hat CVE, Feedly).

1. Reconnaissance: Identify systems running a vulnerable version of X.Org X Server (before 21.1.15/21.1.25 RPM) or XWayland (before 24.1.14) with an accessible X display socket (e.g., :0).
2. Gain X client access: Obtain a local user session or X client authentication credentials (e.g., via .Xauthority cookie) sufficient to connect to the X server.
3. Craft malicious CopyArea request: Construct an X protocol CopyArea request where the source pixmap has a greater height than the destination pixmap, and the source coordinates (y1, dy_src, dy_dst) are chosen so that y1 - dy_dst + dy_src exceeds the destination pixmap height.
4. Trigger the overflow: Send the crafted request to the X server, causing glamor_upload_boxes() to write beyond the end of the tmp_bits heap buffer during the 24-to-32-bit depth conversion in the CPU-to-FBO upload path.
5. Achieve crash or code execution: Depending on heap layout and memory state, the overflow may crash the X server (DoS) or, with further heap grooming, overwrite adjacent heap metadata to redirect execution flow and achieve arbitrary code execution in the X server context (Red Hat Bugzilla).

• Logs: X server crash logs or core dumps in /var/log/Xorg.0.log or systemd journal showing segmentation faults or heap corruption errors in the glamor or upload_boxes code path.
• Process: Unexpected termination or restart of the Xorg or Xwayland process; unusual child processes spawned by the X server process.
• File System: Unexpected core dump files (e.g., core.*) in the X server working directory or /tmp.
• Network/IPC: Unusual or repeated X protocol connections from unprivileged local users to the X display socket (e.g., /tmp/.X11-unix/X0), particularly with large or malformed CopyArea requests.

The X.Org project has released fixed versions: X.Org X Server 21.1.15 (RPM packages: 21.1.25) and XWayland 24.1.14. The fix correctly sizes the tmp_bits buffer using byte_stride * (pixmap->drawable.height - dy_dst + dy_src) to cover the full source coordinate range. Red Hat has issued patches for RHEL 9 (RHSA-2026:85193) and RHEL 10 (RHSA-2026:85191). SUSE, openSUSE, Amazon Linux 2023/2027, FreeBSD, and OpenBSD have also released updated packages. Users should update to the patched versions immediately; no configuration-based workaround is known (Red Hat Bugzilla, Red Hat Advisory RHEL9, Red Hat Advisory RHEL10).

The vulnerability was part of a broader X.Org security update that patched twelve CVEs simultaneously, nine of which allowed arbitrary code execution, drawing significant attention from the Linux security community (HelpNet Security, Linux Compatible). Gaming-focused Linux outlets also covered the release of X.Org Server 21.1.25 and XWayland 24.1.14 due to their relevance to desktop Linux users (Gaming on Linux). Multiple Linux distributions (Red Hat, SUSE, openSUSE, Amazon Linux, FreeBSD, OpenBSD) issued coordinated advisories, reflecting the broad impact across the ecosystem.