Executive brief
A security flaw has been identified in the X.Org X server, a fundamental component used to manage graphical displays on Linux and Unix-like operating systems. An attacker with access to the system can exploit this vulnerability to crash the display server or potentially view sensitive information stored in the system's memory. This could lead to a disruption of service for users or the unauthorized disclosure of private data.
Technical details
An out-of-bounds read vulnerability exists in the X.Org X server within the XKB geometry processing logic. The root cause is located in the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, where bounds checking is incorrectly performed using only the first key name of each alias entry, failing to validate the second name. An attacker with a local or remote connection to the X11 server can trigger this flaw without user interaction by sending a specially crafted request. Successful exploitation allows the attacker to read uninitialized or out-of-bounds memory, potentially leaking sensitive data or causing the server to crash (DoS). Red Hat has released patches for RHEL 9 via RHSA-2026:19342.
Affected products
- X.Org X Server All versions prior to fix
- Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, 10.0
- TigerVNC TigerVNC 1.15.0-7.el9_8.1 and earlier
Timeline
- 2026-03-25: disclosed: Initial report in Red Hat Bugzilla
- 2026-05-05: advisory: NVD publication date
- 2026-05-19: patched: Red Hat released security updates (RHSA-2026:19342)