CVE-2026-93521: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-93521 is a memory corruption vulnerability in xorg-x11-server affecting the RandR (Resize and Rotate) extension's provider property handling. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR provider properties, allowing a local attacker to trigger an out-of-bounds write via specially crafted property update requests. Successful exploitation can lead to privilege escalation or denial of service (DoS) by crashing the X server. The CVE was published on October 7, 2026, with a patch available as of October 8, 2026, and is rated HIGH severity (Red Hat CVE, Red Hat Bugzilla).

The root cause (CWE-787: Out-of-bounds Write) lies in two bugs within the RRChangeProviderProperty() function's PropModePrepend case: (1) new_value.size is incorrectly set to len (the new data length) rather than total_len (new + existing data), causing loss of tracking for existing property data — a bug that also affects PropModeAppend; and (2) the old_data offset is computed using prop_value->size instead of len, meaning the memory layout [new(len)][old(size)] is corrupted because old_data is placed at the wrong offset. These bugs are analogous to previously fixed issues in RRChangeOutputProperty() (commit 541ab2ecd41d). A local attacker with access to the X server can send crafted ChangeProviderProperty requests to trigger the memory corruption. The vulnerability was discovered by an anonymous researcher working with Trend Micro's Zero Day Initiative (ZDI-CAN-31944) (Red Hat Bugzilla).

Successful exploitation allows a local attacker to corrupt heap memory in the X server process, potentially enabling privilege escalation to the permissions of the X server (which may run with elevated privileges on some configurations) or causing a denial of service by crashing the X server, disrupting all graphical sessions on the affected system. The vulnerability is locally scoped, limiting remote exploitation, but on multi-user systems it could allow an unprivileged local user to escalate privileges or disrupt other users' graphical sessions (Red Hat CVE, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The vulnerability requires local access to the X server, which limits the attack surface compared to remotely exploitable flaws. The CVE status was listed as "Reserved" at time of Feedly ingestion, and no CISA KEV catalog listing or EPSS score data is available in current sources. Detection plugins have been published by Nessus (IDs: 364284, 364336, 365480, 365547, 365552, 365612) and Qualys (ID: 6600923) (Feedly).

1. Gain local access: Obtain a local user account on a system running a vulnerable version of xorg-x11-server with an active X server session.
2. Identify target: Confirm the X server version is unpatched (prior to the fix released October 8, 2026) and that the RandR extension is enabled (default on most desktop Linux systems).
3. Craft malicious property request: Construct a ChangeProviderProperty request targeting a RandR provider property using PropModePrepend or PropModeAppend mode with carefully sized data to exploit the incorrect buffer size calculation and offset computation.
4. Send request to X server: Submit the crafted request to the X server via the local display connection (e.g., using Xlib or XCB APIs with DISPLAY set to the target display).
5. Trigger memory corruption: The flawed RRChangeProviderProperty() function writes data to an incorrect memory offset, causing heap corruption.
6. Achieve objective: Depending on heap layout and exploitation technique, either crash the X server (DoS) or leverage the memory corruption to redirect execution flow and escalate privileges (Red Hat Bugzilla).

• Logs: Unexpected X server crash logs or core dumps in /var/log/Xorg.0.log or systemd journal entries showing X server process termination; repeated BadValue or BadAlloc X protocol errors in X server logs.
• Process: Unusual child processes spawned by the X server process (e.g., shells or network tools) that could indicate successful privilege escalation post-exploitation.
• File System: Unexpected core dump files (e.g., core.*) in the X server working directory or /tmp; new SUID binaries or modified system files created around the time of X server crashes.
• Network: Outbound connections from the X server process to unexpected external hosts (if exploitation leads to a reverse shell scenario).

The vulnerability has been patched in xorg-x11-server; Red Hat Enterprise Linux 9 users should apply errata RHSA-2026:82015, available as of October 13, 2026 (Red Hat Errata). SUSE users should apply SUSE-SU-2026:4636-1, SUSE-SU-2026:4645-1, or SUSE-SU-2026:4663-1 as applicable (SUSE Advisory). Upstream releases Xorg Server 21.1.25 and Xwayland 24.1.14 include the fix (Gaming on Linux). As a workaround where patching is not immediately possible, restrict local user access to X server connections and apply the principle of least privilege to limit X server process permissions.

The vulnerability was part of a broader batch of 12 CVEs patched in Xorg Server 21.1.25 and Xwayland 24.1.14, with nine of the twelve allowing arbitrary code execution, drawing significant attention from the Linux security community (Help Net Security, Gaming on Linux). Coverage appeared across multiple security outlets including Help Net Security, DeafNews, and News4Hackers, emphasizing the severity of the overall patch batch. OpenBSD, FreeBSD, SUSE, Red Hat, and Oracle all issued advisories or errata in rapid succession following the upstream disclosure (OpenBSD Errata, FreeBSD VuXML).