xorg-server-21.1.25

[Bruce Dubbs]

New point version.

[Joe Locash]

This release contains the fixes for the issues reported in today's
security advisory:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html

* CVE-2026-88812: XKB SetGeometry TextDoodad Double Free
* CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free
* CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free
* CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow
* CVE-2026-93518: XKB ResizeKeyType Numeric Truncation
* CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow
* CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write
* CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow
* CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow
* CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write
* CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
* CVE-2026-93536: GestureBuildSprite Use-After-Free

In addition we have a variety of fixes outlined by the shortlog below.

Alan Coopersmith (12):
      gitlab CI: add workflow rules
      xkb: Fix -Wcalloc-transposed-args warning in _XkbCopyGeom()
      xf86: prevent passing NULL pointer as strcpy destination
      xf86: prevent passing NULL pointer as strcat() destination
      xf86: silence -Wanalyzer-possible-null-dereference warning in parser
      test: silence -Wanalyzer-null-argument warnings in strndup tests
      exa: silence -Wold-style-declaration warning from gcc 16
      xf86: handle malloc failure in DoSubstitution()
      Handle -Wimplicit-fallthrough warnings from gcc 16.1
      meson: only install dri3.h if building dri3 support
      meson: check cpu_family() instead of cpu()
      xf86: mark wasset unused in xf86UnblockSIGIO() compatibility wrapper

Gary T. Giesen (2):
      xfree86: set GPU screen FB/DGA defaults on runtime hotplug
      config/udev: guard against NULL subsystem in fallback bus id

Jeremy Huddleston Sequoia (9):
      xquartz: Activate the app via xp_window_activate() in -set_front_process:
      xquartz/GL: Log failures on the indirect GLX make-current path
      fb: Don't widen the planemask over padding bits when ROOTLESS_SAFEALPHA is set
      RegionValidate: Fix double free of badreg->data on the error path
      damage: Unlink a damage from the list it was actually inserted on
      xkb: Guard XkbAdjustGroup() against a keymap with no groups
      xkb: Default to one group whenever a keymap reports none
      xkb: Never recompute a keymap's group count down to zero
      xkb: Keep the group counts of a loaded keymap in range

Lukáš Lipinský (2):
      Xi: byte-swap DeviceChanged valuator and scroll data
      Xi: byte-swap XIQueryDevice ScrollClass flags

Martin von Gagern (1):
      modesetting: Check for NULL mode_output before printing warning message

Michel Dänzer (1):
      ci: Prevent duplicate pipelines for MRs

NetSysFire (1):
      xorg.conf.man: Fix escape sequence typo

Octavia Togami (1):
      Fix use-after-free caused by duplicate glyphs in one glyphset

Peter Hutterer (12):
      xkb: NULL text pointer after free in _CheckSetDoodad error path
      xkb: allocate names->keys to MAP_LENGTH in XkbAllocNames
      xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int
      xkb: fix CheckKeySyms overwriting request-range symsPerKey entries
      randr: fix size and offset in RRChangeProviderProperty PrependMode
      Xi: validate modifier values in ProcXIPassiveUngrabDevice
      glx: validate dataBytes against cmdlen in RenderLarge first request
      present: unlink notifies from window list in present_clear_window_notifies
      dix: remove passive grabs referencing a device on removal
      Xi: add bounds check for barrier events in input_constrain_cursor
      Xi: clean up gesture sprite traces in WindowGone
      xserver 21.1.25

dongshengyuan (1):
      enhance: popen-fdopen-error-handling

pkubaj (1):
      meson: Fix build on FreeBSD/powerpc*

stefan11111 (1):
      glamor: Set `need_free_region` immediately after pixman region allocation

git tag: xorg-server-21.1.25

Fixed at f3bbb196d8. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-058 has been issued.