A flaw was found in the X

#!/usr/bin/env bash
# check-cve-2026-34001.sh
# Conservative host-side checker for CVE-2026-34001
# Exit codes: 0=PATCHED/NOT INSTALLED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR

set -u

status="PATCHED"
notes=()

add_note() {
  notes+=("$1")
}

set_vuln() {
  status="VULNERABLE"
}

set_unknown() {
  if [ "$status" != "VULNERABLE" ]; then
    status="UNKNOWN"
  fi
}

os_id=""
os_codename=""
if [ -r /etc/os-release ]; then
  . /etc/os-release
  os_id="${ID:-}"
  os_codename="${VERSION_CODENAME:-}"
fi

check_dpkg_pkg() {
  local pkg="$1"
  dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null
}

check_rpm_pkg() {
  local pkg="$1"
  rpm -q --qf '%{EPOCH}:%{VERSION}-%{RELEASE}\n' "$pkg" 2>/dev/null
}

if command -v dpkg-query >/dev/null 2>&1; then
  xorg_ver="$(check_dpkg_pkg xserver-xorg-core || true)"
  xwayland_ver="$(check_dpkg_pkg xwayland || true)"

  if [ -n "$xorg_ver" ]; then
    add_note "xserver-xorg-core=$xorg_ver"
    case "$os_id:$os_codename" in
      debian:bookworm)
        if dpkg --compare-versions "$xorg_ver" lt "2:21.1.7-3+deb12u12"; then set_vuln; fi
        ;;
      debian:trixie)
        if dpkg --compare-versions "$xorg_ver" lt "2:21.1.16-1.3+deb13u2"; then set_vuln; fi
        ;;
      debian:bullseye)
        set_vuln
        add_note "Debian bullseye tracker marks xorg-server postponed/minor rather than fixed"
        ;;
      debian:forky|debian:sid|debian:unstable)
        if dpkg --compare-versions "$xorg_ver" lt "2:21.1.22-1"; then set_vuln; fi
        ;;
      ubuntu:*)
        set_unknown
        add_note "Ubuntu lists xorg-server/xwayland as needs evaluation on the public tracker; manual review required"
        ;;
      *)
        set_unknown
        add_note "Unrecognized dpkg-based distro for authoritative backport comparison"
        ;;
    esac
  fi

  if [ -n "$xwayland_ver" ]; then
    add_note "xwayland=$xwayland_ver"
    case "$os_id:$os_codename" in
      debian:bookworm|debian:trixie)
        set_vuln
        add_note "Debian notes bookworm/trixie xwayland cases as ignored/minor because Xwayland should not run as root"
        ;;
      debian:forky|debian:sid|debian:unstable)
        if dpkg --compare-versions "$xwayland_ver" lt "2:24.1.10-1"; then set_vuln; fi
        ;;
      ubuntu:*)
        set_unknown
        add_note "Ubuntu xwayland public status is needs evaluation; manual review required"
        ;;
      *)
        set_unknown
        add_note "Unrecognized dpkg-based distro for authoritative xwayland backport comparison"
        ;;
    esac
  fi

  if [ -z "$xorg_ver" ] && [ -z "$xwayland_ver" ]; then
    echo "PATCHED - X.Org/Xwayland packages not installed"
    exit 0
  fi

elif command -v rpm >/dev/null 2>&1; then
  xorg_ver="$(check_rpm_pkg xorg-x11-server-Xorg || true)"
  xwayland_ver="$(check_rpm_pkg xorg-x11-server-Xwayland || true)"
  suse_xorg_ver="$(check_rpm_pkg xorg-x11-server || true)"
  suse_xwayland_ver="$(check_rpm_pkg xwayland || true)"

  [ -n "$xorg_ver" ] && add_note "xorg-x11-server-Xorg=$xorg_ver"
  [ -n "$xwayland_ver" ] && add_note "xorg-x11-server-Xwayland=$xwayland_ver"
  [ -n "$suse_xorg_ver" ] && add_note "xorg-x11-server=$suse_xorg_ver"
  [ -n "$suse_xwayland_ver" ] && add_note "xwayland=$suse_xwayland_ver"

  if [ -z "$xorg_ver" ] && [ -z "$xwayland_ver" ] && [ -z "$suse_xorg_ver" ] && [ -z "$suse_xwayland_ver" ]; then
    echo "PATCHED - X.Org/Xwayland packages not installed"
    exit 0
  fi

  # RHEL/Liberty Linux 10 check from vendor-linked backport data
  if [ -n "$xwayland_ver" ]; then
    if rpm -q --quiet --whatprovides 'xorg-x11-server-Xwayland >= 24.1.5-6.el10_1' 2>/dev/null; then
      :
    else
      case "$os_id" in
        rhel|almalinux|rocky|centos|ol|olcne)
          set_unknown
          add_note "RPM package present but authoritative fixed EVR for this release was not fully confirmed in reviewed sources"
          ;;
        opensuse*|sles|sled|sle_hpc)
          set_unknown
          add_note "SUSE uses multiple backported fixed builds by product/release; compare against SUSE advisory manually"
          ;;
        *)
          set_unknown
          add_note "Unrecognized RPM-based distro for authoritative backport comparison"
          ;;
      esac
    fi
  else
    set_unknown
    add_note "RPM-based system with X.Org components present but no directly comparable Xwayland package"
  fi

else
  echo "UNKNOWN - no supported package manager found"
  exit 2
fi

case "$status" in
  VULNERABLE)
    echo "VULNERABLE - ${notes[*]}"
    exit 1
    ;;
  PATCHED)
    echo "PATCHED - ${notes[*]}"
    exit 0
    ;;
  UNKNOWN)
    echo "UNKNOWN - ${notes[*]}"
    exit 2
    ;;
  *)
    echo "ERROR - unexpected state"
    exit 3
    ;;
esac