ELSA-2026-19349

Описание

[2:2.11.7-7.3]

• Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159860

[2:2.11.7-7.2]

• Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
• Fix growth of preallocated buffers (CVE-2026-27951)
• Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
• Add DSP format checks (CVE-2026-31884)
• Fix DSP array bounds checks (CVE-2026-31883)
• Fix DSP array bounds checks (CVE-2026-31885)
• Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) Resolves: RHEL-159816, RHEL-155478, RHEL-161047, RHEL-161482 Resolves: RHEL-161519, RHEL-161085, RHEL-168463

[2:2.11.7-7.1]

• Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
• Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-163097, RHEL-163113