Bug 2545178 (CVE-2026-93522)

Summary:	CVE-2026-93522 xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in xorg-x11-server. In the Glamor 2D graphics acceleration module, a buffer allocation error occurs during color depth conversion when processing an image whose source dimensions exceed the destination dimensions. A local user can exploit this vulnerability to trigger an out-of-bounds memory write, potentially leading to privilege escalation, arbitrary code execution, or a denial of service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2555546, 2555545
Bug Blocks:
Deadline:	2026-10-07

Description OSIDB Bzimport 2026-10-02 13:04:41 UTC

glamor_upload_boxes() allocates the tmp_bits buffer (used for 24-bit to
32-bit depth conversion) based on the destination pixmap height, but
indexes it using source coordinates (y1 - dy_dst + dy_src). When the
source is taller than the destination, the source-relative offset
exceeds the destination height, causing writes past the buffer end.

Size the buffer to account for the source coordinate mapping:
byte_stride * (pixmap->drawable.height - dy_dst + dy_src). This
ensures the buffer covers the full range of source rows that will be
accessed during the upload.

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-32361

Comment 1 Jon Orris 2026-10-19 14:14:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:85191 https://access.redhat.com/errata/RHSA-2026:85191

Comment 2 Jon Orris 2026-10-19 14:40:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:85193 https://access.redhat.com/errata/RHSA-2026:85193