CVE-2026-93522: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-93522 is a heap buffer overflow vulnerability in the Glamor acceleration layer of the X.Org X server (xorg-x11-server) and Xwayland, specifically in the glamor_upload_boxes() function. The flaw was discovered by an anonymous researcher working with Trend Micro's Zero Day Initiative (ZDI-CAN-32361) and disclosed on October 7, 2026. It affects xorg-x11-server and Xwayland versions prior to the fixes released in X.Org Server 21.1.25 and Xwayland 24.1.14. Feedly estimates the severity as HIGH, and it was patched by Red Hat via RHSA-2026:85191 (RHEL 10) and RHSA-2026:85193 (RHEL 9) (Red Hat Bugzilla, Red Hat CVE).

The root cause is an incorrect buffer size calculation in glamor_upload_boxes(), which allocates the tmp_bits buffer (used for 24-bit to 32-bit depth conversion) based on the destination pixmap height, but indexes it using source coordinates (y1 - dy_dst + dy_src). When the source pixmap is taller than the destination, the source-relative offset exceeds the allocated buffer size, resulting in out-of-bounds writes past the buffer end — a classic heap buffer overflow (CWE-122). The correct fix is to size the buffer as byte_stride * (pixmap->drawable.height - dy_dst + dy_src) to cover the full range of source rows accessed during the upload. This vulnerability is part of a broader batch of 12 CVEs patched simultaneously in X.Org Server and Xwayland (Red Hat Bugzilla, HelpNet Security).

Successful exploitation of this heap buffer overflow could allow a local attacker or a malicious client application to corrupt heap memory, potentially leading to arbitrary code execution in the context of the X server process. Since the X server often runs with elevated privileges, exploitation could result in local privilege escalation, full system compromise, or denial of service. The vulnerability is part of a set where nine of twelve patched CVEs were reported to allow arbitrary code execution (deafnews.it, Red Hat Bugzilla).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-93522 as of the available data. The vulnerability was responsibly disclosed through the Trend Micro Zero Day Initiative (ZDI-CAN-32361) by an anonymous researcher. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no EPSS score data is available in the provided sources. Detection plugins have been published by Nessus (IDs: 364284, 364336, 367281, 367377, 367397, 367723, 367725) and Qualys (IDs: 765889, 6601011, 6601001) (Red Hat Bugzilla, Tenable).

Users should upgrade to X.Org Server 21.1.25 or Xwayland 24.1.14 or later, which contain the fix for this vulnerability. Red Hat Enterprise Linux users should apply RHSA-2026:85191 (RHEL 10) or RHSA-2026:85193 (RHEL 9). SUSE users should apply SUSE-SU-2026:4835-1, and openSUSE users should apply the corresponding security announcement. OpenBSD errata 79 also addresses this issue. FreeBSD users can refer to the VuXML entry. As a temporary workaround where patching is not immediately possible, disabling Glamor acceleration in the X server configuration may reduce exposure (Red Hat Bugzilla, SUSE Advisory, OpenBSD Errata).

The disclosure of 12 simultaneous CVEs in X.Org Server and Xwayland — nine of which allow arbitrary code execution — drew notable attention from the Linux and security communities. Gaming on Linux and HelpNet Security covered the releases of X.Org Server 21.1.25 and Xwayland 24.1.14 as significant security updates. Multiple Linux distributions including Red Hat, SUSE, openSUSE, FreeBSD, and OpenBSD issued rapid security advisories and patches. The broader batch was characterized by security news outlets as a critical update requiring prompt action (Gaming on Linux, HelpNet Security, deafnews.it).