CVE-2026-109092

X.Org X server and Xwayland: ProcXvShmPutImage checked sizeneeded + offset against the SHM segment size; a negative sizeneeded plus a crafted offset wraps the addition so the bounds check passes and an invalid source pointer reaches PutImage out-of-bounds read/write. Fixed in xorg-server 21.1.26...