CVE-2026-109093

X.Org X server and Xwayland: ProcXTestFakeInput copies DeviceValuator fields into a fixed stack array MAXVALUATORS before checking that the valuator range fits, so enough DeviceValuator events write past the array stack out-of-bounds write. Fixed in xorg-server 21.1.26 and xwayland 24.1.15 X.Org...