CVE-2026-88812

high

Published 2026-10-13 · Modified 2026-10-13

Discuss on Community Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.0

Description

RHSA-2026:82015: xorg-x11-server security update (Important)

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-88812 NameCVE-2026-88812 DescriptionXKB SetGeometry TextDoodad Double Free SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Debian Bugs1150213, 1150214 Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus…

CVE-2026-88812

Name	CVE-2026-88812
Description	XKB SetGeometry TextDoodad Double Free
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150213, 1150214

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xorg-server (PTS)	bookworm	2:21.1.7-3+deb12u12	vulnerable
	bookworm (security)	2:21.1.7-3+deb12u13	vulnerable
	trixie	2:21.1.16-1.3+deb13u3	vulnerable
	trixie (security)	2:21.1.16-1.3+deb13u4	vulnerable
	forky, sid	2:21.1.24-1	vulnerable
xwayland (PTS)	bookworm	2:22.1.9-1	vulnerable
	trixie	2:24.1.6-1	vulnerable
	forky, sid	2:24.1.13-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
xorg-server	source	(unstable)	2:21.1.25-1			1150214
xwayland	source	(unstable)	2:24.1.14-1	unimportant		1150213

Notes

Xwayland shouldn't be running as root, cf. README.Debian.security
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-server-21.1.25)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

Xwayland shouldn't be running as root, cf. README.Debian.securityhttps://lists.x.org/archives/xorg-announce/2026-October/003747.htmlFixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-server-21.1.25)

OS impact

Debian Mixed 4 releases

Version	Package	Status	Fixed in
trixie	`xwayland` `xorg-server`	Affected	—
sid	`xwayland`	Fixed	`2:24.1.14-1`
sid	`xorg-server`	Fixed	`2:21.1.25-1`
forky	`xwayland`	Fixed	`2:24.1.14-1`
forky	`xorg-server`	Affected	—
bookworm	`xwayland` `xorg-server`	Affected	—

Alpine Fixed 1 release

Version	Package	Status	Fixed in
v3.24	`xwayland`	Fixed	`24.1.14-r0`
v3.24	`xorg-server`	Fixed	`21.1.25-r0`

Red Hat Fixed 1 release

Version	Package	Status	Fixed in
9	`xorg-x11-server-Xdmx` `xorg-x11-server-Xephyr` `xorg-x11-server-Xnest` +5 more	Fixed	`1.20.11-34.el9_8.4`

SUSE Tracked 1 release

Version	Package	Status	Fixed in
—	—	Unknown	—

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.