This advisory covers five distinct vulnerabilities in the xorg-x11-server-Xwayland package used in Red Hat Enterprise Linux 9.0. The issues include: CVE-2026-33999, a denial of service caused by an integer underflow in XKB compatibility map handling; CVE-2026-34000 and CVE-2026-34002, information disclosure and denial of service through out-of-bounds reads in XKB geometry and modifier map processing; CVE-2026-34001, a use-after-free vulnerability leading to server crashes and potential memory corruption; and CVE-2026-34003, information exposure and denial of service via out-of-bounds memory access. These vulnerabilities impact the X.Org X server's handling of keyboard-related data structures when running X clients under Wayland via Xwayland. Red Hat has released updated packages to remediate these issues.

Successful exploitation of these vulnerabilities can result in denial of service conditions causing the X server to crash or become unresponsive. Some vulnerabilities also allow information disclosure through out-of-bounds memory reads, potentially exposing sensitive data. The use-after-free vulnerability may lead to memory corruption, increasing the risk of instability or further exploitation. These issues affect the graphical server environment on affected Red Hat Enterprise Linux 9.0 systems running Xwayland.

Red Hat has released an important security update for xorg-x11-server-Xwayland in Red Hat Enterprise Linux 9.0 that addresses these vulnerabilities. Users should apply the update as soon as possible following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory. Patch status is confirmed as fixed in the updated packages provided by Red Hat.