ALAS2023-2026-1613

References: CVE-2026-33999  CVE-2026-34000  CVE-2026-34001  CVE-2026-34002  CVE-2026-34003 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

XKB Integer Underflow in XkbSetCompatMap() (CVE-2026-33999)

XKB Out-of-bounds Read in CheckSetGeom() (CVE-2026-34000)

XSYNC Use-after-free in miSyncTriggerFence() (CVE-2026-34001)

XKB Out-of-bounds read in CheckModifierMap() (CVE-2026-34002)

XKB Buffer overflow in CheckKeyTypes() (CVE-2026-34003)

Issue Correction:
Run dnf update xorg-x11-server-Xwayland --releasever 2023.11.20260427 or dnf update --advisory ALAS2023-2026-1613 --releasever 2023.11.20260427 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    xorg-x11-server-Xwayland-debuginfo-24.1.3-1.amzn2023.0.4.aarch64
    xorg-x11-server-Xwayland-devel-24.1.3-1.amzn2023.0.4.aarch64
    xorg-x11-server-Xwayland-24.1.3-1.amzn2023.0.4.aarch64
    xorg-x11-server-Xwayland-debugsource-24.1.3-1.amzn2023.0.4.aarch64

src:
    xorg-x11-server-Xwayland-24.1.3-1.amzn2023.0.4.src

x86_64:
    xorg-x11-server-Xwayland-debuginfo-24.1.3-1.amzn2023.0.4.x86_64
    xorg-x11-server-Xwayland-debugsource-24.1.3-1.amzn2023.0.4.x86_64
    xorg-x11-server-Xwayland-24.1.3-1.amzn2023.0.4.x86_64
    xorg-x11-server-Xwayland-devel-24.1.3-1.amzn2023.0.4.x86_64