xorg-server-21.1.26

[Joe Locash]

New point release with security fixes.

This release contains the fixes for the issues reported in today's
security advisory:

https://lists.x.org/archives/xorg-announce/2026-November/003759.html

* CVE-2026-109091: X.Org Server EDID DS_RANGES Out-Of-Bounds Write
* CVE-2026-109092: X.Org Server XvShmPutImage Shared-Memory Bounds Overflow
* CVE-2026-109093: X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write
* CVE-2026-109904: X.Org Server XRes QueryClientIds Request Size Overflow
* CVE-2026-109094: X.Org Server XRes QueryResourceBytes Swap Path Size Overflow
* CVE-2026-109095: X.Org Server glamor Xv Image Size Integer Overflow
* CVE-2026-109096: X.Org Server XvPutImage Negative Image Size Length Bypass
* CVE-2026-109903: X.Org Server XvQueryImageAttributes Negative Size Reply

In addition we have a variety of fixes outlined by the shortlog below:

Acts1631 (3):
       Xv: prevent overflow in shared-memory bounds check
       XTest: validate valuator range before writing
       XRes: prevent overflow in client ID request size

Alan Coopersmith (4):
       Revert "damage: Unlink a damage from the list it was actually inserted on"
       Xi: avoid memory leak when hitting bounds check for barrier events
       Xi: fix event_id & time delta in generated barrier events
       xkb: fix typo in sizeof expression

Matt Turner (2):
       meson: don't build the int10 helpers for the stub backend
       meson: use the right cpu family name for 32-bit x86 in int10

Olivier Fourdan (7):
       xfree86: bound EDID DS_RANGES against hsync/vrefresh array size
       test: cover EDID DS_RANGES overflow of hsync/vrefresh arrays
       XRes: prevent overflow in resource bytes swap path
       glamor: prevent overflow in Xv image size calculation
       Xv: reject negative image size in PutImage
       Xv: reject negative image size in QueryImageAttributes
       xserver 21.1.26

git tag: xorg-server-21.1.26

[Joe Locash]

Fixed at 40c9bd6099. Leaving open for SA.