This security advisory covers five vulnerabilities in the X.Org X server's xorg-x11-server component, impacting Red Hat Enterprise Linux 9.4 Extended Update Support and related builds. The vulnerabilities include: CVE-2026-33999, a denial of service caused by an integer underflow in XKB compatibility map handling; CVE-2026-34000, information disclosure and denial of service via out-of-bounds read in XKB geometry processing; CVE-2026-34001, a use-after-free vulnerability that can cause server crashes and potential memory corruption; CVE-2026-34002, information disclosure or denial of service via out-of-bounds read in XKB modifier map handling; and CVE-2026-34003, information exposure and denial of service through out-of-bounds memory access. These vulnerabilities affect the core functionality of the X Window System's graphical interface server and could impact system stability and confidentiality. Red Hat has released updated packages to address these issues.

The vulnerabilities can lead to denial of service conditions causing the X.Org X server to crash or become unstable. Some issues also allow information disclosure through out-of-bounds memory reads, potentially exposing sensitive data. The use-after-free vulnerability may cause memory corruption, which could further destabilize the server or lead to undefined behavior. These impacts affect the graphical interface layer on affected Red Hat Enterprise Linux 9.4 systems, potentially disrupting user sessions and exposing information.

Red Hat has released updated xorg-x11-server packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related products that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:20555 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No alternative mitigations or workarounds are indicated in the advisory.