Back to Security Advisories

LibXi Security Update — AlmaLinux 8 (ALSA-2026:93438)

ALSA-2026:93438 updates libXi on AlmaLinux 8, fixing CVE-2026-109090 and CVE-2026-109089 — arbitrary code execution via oversized DEVICE_ENABLE replies from a malicious X server. Update with dnf update libXi and restart X applications; headless servers without X are unaffected.

High 7.5 CVSS
AlmaLinux 8

What this means under a SharedLicense license

Same inverted threat model as the libXrender and libX11 fixes: a malicious X server overflows the connecting client's heap — one compromised X host attacks every client application that connects to it.

Type:

security

Severity:

important

Release date:

2026-11-02

Description:

X.Org X11 libXi runtime library

Security Fix(es):

* libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090)
* libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 libXi-1.7.10-4.el8_10.aarch64.rpm 067696447b02236f69d688a9db0227368c9a2b2a4057653c66737099ecef2239
aarch64 libXi-devel-1.7.10-4.el8_10.aarch64.rpm ba5bee312cb2e7b65e3b9040cb797ef3302eef0cadd0495fca9189b2eff1029c
i686 libXi-1.7.10-4.el8_10.i686.rpm 66f69b2b0f4e6e4cfbb7436f6c69860d16a2f1ec384c9a873c0b06a538f02841
i686 libXi-devel-1.7.10-4.el8_10.i686.rpm a8125e9a27eaf73f1da5b48a5db36d715d4d256d0db047c0c72cedbc7028f10d
ppc64le libXi-1.7.10-4.el8_10.ppc64le.rpm 00f642433f647d8fe12b792563c7e4f29583061a4b2022d60d3c986a4742412f
ppc64le libXi-devel-1.7.10-4.el8_10.ppc64le.rpm 2ec946424c2284532556ea119e5973de002a13960bd78fb454ed6582ea874665
s390x libXi-1.7.10-4.el8_10.s390x.rpm 3324c63bb9a64fc0c4ad91658253b1524ab1444e50fd5b378d3f4ef52083d745
s390x libXi-devel-1.7.10-4.el8_10.s390x.rpm d58b6de4bb454d0e6c7e6a091204881d3f4d07c8f480f4721ecca9b46f75fd85
x86_64 libXi-1.7.10-4.el8_10.x86_64.rpm a4635dbe4fc3367f6f24ced6e8acd764a1c331e58ef52d7df9bea794e7e081f4
x86_64 libXi-devel-1.7.10-4.el8_10.x86_64.rpm b1f17de572312a2c4636e8f5df163c1a04cebfc1be1f2c2248379b97e360d5d1

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is CVE-2026-109090?
It is an arbitrary code execution flaw in libXi triggered by an oversized DEVICE_ENABLE reply from a malicious X server (oversized-reply class), fixed with CVE-2026-109089 in the AlmaLinux 8 update ALSA-2026:93438.
Who is affected?
Systems running X11 applications that connect to an X server — the client library parses server replies, so the server side is the attack source. Headless servers without X clients are unaffected.
How do I apply the fix?
Run dnf update libXi and restart X applications so they reload the patched library. No reboot required.
Is this part of the X11 library security wave?
Yes — libXrender, libXtst, libX11 and libXi all received fixes in this window; they share protocol-parsing code, so batches land together. Apply all X11 library updates together.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System