X.Org has fixed eight security flaws in the X.Org X server and Xwayland, the display software that still powers a large share of Linux desktops. The fixes were published on 10 November 2026 in xorg-server 21.1.26 and xwayland 24.1.15, and every earlier version is affected.

The update matters well beyond traditional X11 desktops. Xwayland lets X11 applications run on desktops built on Wayland, the newer display protocol, so Wayland users who run older X11 software are exposed to the same flaws and need the same update.

A monitor can be the attack tool

The most striking flaw is tracked as CVE-2026-109091. It sits in the code that reads EDID, the block of data a monitor sends to describe the resolutions and refresh rates it supports. The server records display-range descriptors into fixed-size arrays without checking them against the expected limits, so a malicious monitor, or a crafted EDID block, can supply extra descriptors that overrun those arrays and corrupt neighbouring memory or crash the server.

Four of the eight flaws sit in Xv, the X Video extension that applications use to pass video frames to the server. They include CVE-2026-109092, a shared-memory bounds overflow in XvShmPutImage, and CVE-2026-109093, a stack out-of-bounds write in the XTest extension that lets clients inject fake keyboard and mouse events. The remaining flaws affect XRes resource queries and the glamor video path, tracked as CVE-2026-109904, CVE-2026-109094, CVE-2026-109095, CVE-2026-109096 and CVE-2026-109903.

Who should update

Anyone running a Linux desktop on X11, or running X11 applications through Xwayland, should install the update as soon as their distribution makes it available, either through the normal package manager or a system update. X.Org has published no severity ratings or CVSS scores for the eight flaws and has not said whether any of them could lead to code execution, so users should not assume the risk is low.

The release comes about a month after xorg-server 21.1.25, which fixed 12 flaws. Phoronix reported that the latest flaws were identified with assistance from AI tools. The fixes are also a reminder that the display server, a component most users never think about, remains a valuable target: it handles input from keyboards, mice, monitors and applications, and a flaw there can reach the heart of the desktop.

Help Net Security and X.Org have published the details of the advisory and the fixed versions.