This advisory covers five distinct vulnerabilities in the X.Org X server's Xwayland component used in Red Hat Enterprise Linux 9.4 EUS. The issues include CVE-2026-33999 (denial of service via integer underflow in XKB compatibility map handling), CVE-2026-34000 (information disclosure and denial of service via out-of-bounds read in XKB geometry processing), CVE-2026-34001 (use-after-free causing server crash and potential memory corruption), CVE-2026-34002 (information disclosure or denial of service via out-of-bounds read in XKB modifier map handling), and CVE-2026-34003 (information exposure and denial of service via out-of-bounds memory access). These vulnerabilities can lead to denial of service, information leakage, and potential memory corruption in the Xwayland server. Red Hat has released updated packages to address these issues for multiple architectures and variants of Red Hat Enterprise Linux 9.4.

The vulnerabilities can cause denial of service conditions by crashing the Xwayland server, potentially leading to loss of graphical session availability. Some issues allow information disclosure through out-of-bounds memory reads, which could expose sensitive data. The use-after-free vulnerability may lead to memory corruption, increasing the risk of instability or further exploitation. These impacts affect systems running the vulnerable versions of xorg-x11-server-Xwayland on Red Hat Enterprise Linux 9.4 Extended Update Support.

Red Hat has released updated xorg-x11-server-Xwayland packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:20560 to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.