Skip to content

Conversation

@pmenzel
Copy link
Collaborator

Tested on sigusr2.

The release fixes twelve CVEs from [today’s security advisory][1]
(CVE-2026-88812, CVE-2026-93515 to CVE-2026-93524, CVE-2026-93536):

The tarball matches the announced checksum:

    $ sha256sum xorg-server-21.1.25.tar.xz
    6ad4e3c7b59a309b32c92e5c15ce1267110f9e13f1ac78da62361a628da1a0eb  xorg-server-21.1.25.tar.xz

and carries a good signature by Peter Hutterer:

    $ gpg --verify xorg-server-21.1.25.tar.xz.sig xorg-server-21.1.25.tar.xz
    gpg: Signature made Wed Oct  7 03:42:25 2026 CEST
    gpg:                using DSA key 3C2C43D9447D5938EF4551EBE23B7E70B467F0BF
    gpg: Good signature from "Peter Hutterer <peter.hutterer@who-t.net>" [unknown]
    gpg: WARNING: This key is not certified with a trusted signature!
    gpg:          There is no indication that the signature belongs to the owner.
    Primary key fingerprint: 3C2C 43D9 447D 5938 EF45  51EB E23B 7E70 B467 F0BF

`xorg-server-no-chown-root.patch` still applies (offset -3 lines).

[1]: https://lists.x.org/archives/xorg-announce/2026-October/003747.html

Assisted-by: claude-opus-5.5 (Claude Code)
@pmenzel Paul Menzel (pmenzel) merged commit 28ab5c9 into master Oct 7, 2026
Sign in to join this conversation on GitHub.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant