Brief Summary: CVE-2026-50258 Stack Buffer Overflow in X.Org X Server and Xwayland XKB Extension

Introduction

An incomplete fix for a 2025 XKB buffer overflow has left the X.Org X server and Xwayland vulnerable to a new stack overflow that can crash the display server or, on legacy systems running X as root, hand an authenticated attacker full privilege escalation. CVE-2026-50258, carrying a CVSS score of 7.8, was disclosed on June 2, 2026 as part of a broader X.Org security advisory covering nine vulnerabilities, seven of which were discovered through the TrendAI Zero Day Initiative.

Technical Information

Root Cause

CVE-2026-50258 is a stack-based buffer overflow (CWE-121) in the X Keyboard Extension (XKB) subsystem, specifically in the CheckKeyTypes() function within xkb/xkb.c. The X server maintains multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups for processing keyboard mapping data. The core issue is that CheckKeyTypes() historically validated only the lower bound of the numLevels (also called width) parameter, ensuring it was not less than 1. It did not enforce an upper bound against XkbMaxShiftLevel, which is defined as 63.

This meant a malicious X client could submit key type definitions with numLevels set to values as high as 255, far exceeding the architectural maximum. The server would accept and store these oversized key types without complaint.

Relationship to CVE-2025-26597

This vulnerability is explicitly the product of an incomplete prior fix. CVE-2025-26597, published February 25, 2025, addressed a buffer overflow in XkbChangeTypesOfKey() where calling the function with a 0 group would resize the key symbols table to 0 but leave the key types unchanged, leading to a buffer overflow. That vulnerability was fixed in xorg-server 21.1.16 and xwayland 24.1.6. However, the 2025 fix did not address the related validation gap in CheckKeyTypes(), leaving the path open for CVE-2026-50258. Both vulnerabilities reside in the XKB code path and involve failures to properly validate array indices against fixed-size internal buffers.

Attack Flow

The attack proceeds in two stages:

Stage 1: Poisoning the type table. An authenticated X client sends an XkbSetMap request containing a maliciously crafted key type definition where num_levels exceeds XkbMaxShiftLevel. Because CheckKeyTypes() does not reject or clamp this value, the server accepts and stores the oversized key type in its internal type table. The buffer overflow is not triggered at this point.

Stage 2: Triggering the overflow. The overflow occurs during a subsequent core keyboard mapping change. When ChangeKeyboardMapping triggers XkbUpdateKeyTypesFromCore, the code path invokes XkbKeyTypesForCoreSymbols. This function computes a groupsWidth value directly from the attacker-controlled num_levels. It then uses the XKB_OFFSET macro to calculate indices into tsyms[], a stack-allocated buffer:

XKB_OFFSET(g, l) = (g * groupsWidth) + l

The tsyms[] buffer is sized for XkbMaxSymsPerKey (252 entries). With num_levels set to 255, groupsWidth becomes 255, and the computed indices can reach values as high as 3 * 255 + 254 = 1019, overflowing the 252-element stack buffer by 767 KeySym-sized entries. This overflow affects three separate stack buffers in the same code path, providing multiple memory corruption opportunities.

Impact

The 767-entry overflow of a stack buffer provides substantial control over the stack frame, making return address overwrite feasible for an experienced attacker. On systems where the X server runs as root (still found in some legacy or embedded configurations), successful exploitation yields root-level privilege escalation. On Wayland-based systems, Xwayland typically runs under the user's session rather than as root, limiting the impact to user-level code execution. The denial of service (crash) impact remains regardless of privilege level.

Discovery

The vulnerability was discovered by an anonymous researcher working with the TrendAI Zero Day Initiative, tracked as ZDI-CAN-30160. It was disclosed as part of a coordinated advisory alongside eight other X.Org/Xwayland vulnerabilities on June 2, 2026.

Patch Information

The fix for CVE-2026-50258 is a surgically precise, single-line change authored by Peter Hutterer and committed on June 1, 2026, in commit 543e108516428fc8c3bea91d6563ad266f9a801e. The patch lives in xkb/xkb.c and targets the CheckKeyTypes() function.

The original boundary validation if (width < 1) was expanded to include the missing upper bound:

@@ -1652,7 +1652,7 @@ CheckKeyTypes(ClientPtr client,
     }
     n = i + req->firstType;
     width = wire->numLevels;
-    if (width < 1) {
+    if (width < 1 || width > XkbMaxShiftLevel) {
         *nMapsRtrn = _XkbErrCode3(0x04, n, width);
         return 0;
     }

The constant XkbMaxShiftLevel is defined as 63, which is the architectural maximum shift level in XKB. By adding || width > XkbMaxShiftLevel to the existing bounds check, the function now rejects any key type that declares more levels than the protocol permits. When the check fails, it returns an error code (0x04 with the type index and offending width) and the request is denied, using the same error-handling path as the existing width < 1 case.

The fix is included in xorg-server 21.1.23 and xwayland 24.1.12, both released on June 2, 2026. The related merge request on GitLab is !2228.

For organizations unable to upgrade immediately, this minimal change can be backported directly from the commit.

Vendor-specific patches are also available:

Affected Systems and Versions

All versions of the X.Org X server prior to 21.1.23 and Xwayland prior to 24.1.12 are affected. The vulnerability was introduced in X11R6.1, meaning virtually all deployed versions prior to the fix are vulnerable.

The risk profile varies by deployment configuration:

• Systems running X server as root: Full privilege escalation is possible. This configuration is still present in some legacy and embedded deployments.
• Wayland-based systems with Xwayland: Xwayland typically runs under the user's session rather than as root, limiting the impact to user-level code execution and denial of service.
• All configurations: The denial of service (server crash) impact applies regardless of privilege level.

Exploitation requires an authenticated X client connection, meaning either local access or a compromised user session is needed. This limits the attack surface to local privilege escalation or post-compromise persistence scenarios rather than remote unauthenticated access.

Vendor Security History

The X.Org X server has a documented history of security vulnerabilities dating back to at least 2006. The codebase's age (originating from X11R6.1 in the mid-1990s) and the complexity of the X Window System protocol have contributed to recurring vulnerability classes, particularly buffer overflows and memory corruption issues in the XKB, GLX, XSYNC, and DRI2 extensions.

A notable pattern has emerged in recent years. The February 2025 advisory (CVE-2025-26597 and companions) and the June 2026 advisory (CVE-2026-50258 and companions) both involve XKB stack buffer overflows where validation was incomplete. The incomplete nature of the CVE-2025-26597 fix, which left CheckKeyTypes() unguarded while fixing XkbChangeTypesOfKey(), illustrates a challenge with vulnerability remediation in legacy codebases: fixing one code path without auditing all related paths can leave residual weaknesses that are then discovered and reported as new CVEs.

Seven of the nine vulnerabilities in the June 2026 advisory were discovered by anonymous researchers working with the TrendAI Zero Day Initiative, suggesting increased security research attention on the X server codebase. The recurrence of XKB stack buffer overflows across two consecutive CVEs raises the question of whether additional validation gaps remain in the XKB subsystem. Organizations should monitor for further XKB-related CVEs in future X.Org advisories.

References

• CVE-2026-50258, Red Hat Customer Portal
• Red Hat Bugzilla: Bug 2485383
• GitLab Commit: xkb: reject key types with num_levels exceeding XkbMaxShiftLevel
• cgit Commit: 543e108516428fc8c3bea91d6563ad266f9a801e
• X.Org Security Advisory, June 2026
• Red Hat Jira: PSIRTSUPT-16950
• CVE-2025-26597, Red Hat Customer Portal
• CVE-2025-26597 Detail, NVD
• Oracle Linux Errata: ELSA-2026-50258
• GitHub Advisory: GHSA-74fp-pmv2-rh3f
• SUSE Security Update: SUSE-SU-20261330-1
• X.Org Security Advisories
• CISA Known Exploited Vulnerabilities Catalog