ALAS2023-2026-3394

References: CVE-2026-109089  CVE-2026-109090  CVE-2026-93541  CVE-2026-93542  CVE-2026-93543  CVE-2026-93544  CVE-2026-93545  CVE-2026-94281  CVE-2026-94282 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow (CVE-2026-109089)

libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow

NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html
NOTE: https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/26
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/lib/libxi/-/commit/4eb9f70b67034ace1abdf785fd8dcba7b6dc739d (CVE-2026-109090)

A flaw was found in libXi. An out-of-bounds read vulnerability in the XQueryDeviceState() function allows a malicious X server to trigger an application crash. By returning a specially crafted response to a device state query, the server causes the client application to read memory beyond allocated buffer boundaries, resulting in a Denial of Service (DoS). (CVE-2026-93541)

An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client. (CVE-2026-93542)

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. (CVE-2026-93543)

An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client. (CVE-2026-93544)

An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. (CVE-2026-93545)

An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. (CVE-2026-94281)

Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion. (CVE-2026-94282)

Issue Correction:
Run dnf update libXi --releasever 2023.12.20261109 or dnf update --advisory ALAS2023-2026-3394 --releasever 2023.12.20261109 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    libXi-1.8.4-1.amzn2023.0.1.aarch64
    libXi-debuginfo-1.8.4-1.amzn2023.0.1.aarch64
    libXi-debugsource-1.8.4-1.amzn2023.0.1.aarch64
    libXi-devel-1.8.4-1.amzn2023.0.1.aarch64

src:
    libXi-1.8.4-1.amzn2023.0.1.src

x86_64:
    libXi-debugsource-1.8.4-1.amzn2023.0.1.x86_64
    libXi-1.8.4-1.amzn2023.0.1.x86_64
    libXi-debuginfo-1.8.4-1.amzn2023.0.1.x86_64
    libXi-devel-1.8.4-1.amzn2023.0.1.x86_64