A stack-based buffer overflow flaw was found in the X

#!/usr/bin/env bash
# check-cve-2026-50256.sh
# Detect likely exposure to CVE-2026-50256 on Linux hosts.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIX_XORG="21.1.23"
FIX_XWAYLAND="24.1.12"
CVE="CVE-2026-50256"

have_cmd() { command -v "$1" >/dev/null 2>&1; }

ver_lt() {
  # returns 0 if $1 < $2
  [ "$1" = "$2" ] && return 1
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

extract_ver() {
  printf '%s' "$1" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1
}

pkg_query() {
  if have_cmd rpm; then
    rpm -q --qf '%{NAME} %{VERSION}-%{RELEASE}\n' "$1" 2>/dev/null
  elif have_cmd dpkg-query; then
    dpkg-query -W -f='${Package} ${Version}\n' "$1" 2>/dev/null
  else
    return 1
  fi
}

changelog_mentions_cve() {
  if have_cmd rpm; then
    rpm -q --changelog "$1" 2>/dev/null | grep -q "$CVE"
    return $?
  elif have_cmd apt-cache; then
    apt-cache changelog "$1" 2>/dev/null | grep -q "$CVE"
    return $?
  fi
  return 1
}

xorg_ver=""
xwayland_ver=""

if have_cmd Xorg; then
  xorg_ver=$(Xorg -version 2>&1 | extract_ver)
fi
if have_cmd Xwayland; then
  xwayland_ver=$(Xwayland -version 2>&1 | extract_ver)
fi

# Package fallbacks
xorg_pkg_info=""
xwayland_pkg_info=""
for p in xorg-x11-server-Xorg xorg-x11-server xserver-xorg-core; do
  out=$(pkg_query "$p") || true
  if [ -n "$out" ]; then
    xorg_pkg_info="$out"
    [ -z "$xorg_ver" ] && xorg_ver=$(extract_ver "$out")
    break
  fi
done
for p in xorg-x11-server-Xwayland xwayland; do
  out=$(pkg_query "$p") || true
  if [ -n "$out" ]; then
    xwayland_pkg_info="$out"
    [ -z "$xwayland_ver" ] && xwayland_ver=$(extract_ver "$out")
    break
  fi
done

# Changelog/backport hints
backport_patched=0
for p in xorg-x11-server-Xorg xorg-x11-server xserver-xorg-core xorg-x11-server-Xwayland xwayland; do
  if changelog_mentions_cve "$p"; then
    backport_patched=1
    break
  fi
done

# Runtime context
root_xorg="no"
root_xwayland="no"
if ps -eo user,comm,args | grep -E '[[:space:]]Xorg([[:space:]]|$)' | grep -vq grep; then
  if ps -eo user,comm,args | awk '$2=="Xorg" && $1=="root" {found=1} END{exit(found?0:1)}'; then
    root_xorg="yes"
  fi
fi
if ps -eo user,comm,args | grep -E '[[:space:]]Xwayland([[:space:]]|$)' | grep -vq grep; then
  if ps -eo user,comm,args | awk '$2=="Xwayland" && $1=="root" {found=1} END{exit(found?0:1)}'; then
    root_xwayland="yes"
  fi
fi

if [ "$backport_patched" -eq 1 ]; then
  echo "PATCHED - vendor changelog mentions $CVE"
  echo "xorg_version=${xorg_ver:-none} xwayland_version=${xwayland_ver:-none} root_xorg=$root_xorg root_xwayland=$root_xwayland"
  exit 0
fi

seen=0
vuln=0
unknown=0

if [ -n "$xorg_ver" ]; then
  seen=1
  if ver_lt "$xorg_ver" "$FIX_XORG"; then
    vuln=1
  fi
fi

if [ -n "$xwayland_ver" ]; then
  seen=1
  if ver_lt "$xwayland_ver" "$FIX_XWAYLAND"; then
    vuln=1
  fi
fi

if [ "$seen" -eq 0 ]; then
  echo "PATCHED - no Xorg/Xwayland binary or package detected"
  exit 0
fi

# Distro backports can keep old version strings. If we only have package versions
# with distro suffixes and no changelog access, be conservative.
if [ "$vuln" -eq 1 ]; then
  if { [ -n "$xorg_pkg_info" ] && printf '%s' "$xorg_pkg_info" | grep -Eq '(el[0-9]|ubuntu|deb|fc|suse)'; } || \
     { [ -n "$xwayland_pkg_info" ] && printf '%s' "$xwayland_pkg_info" | grep -Eq '(el[0-9]|ubuntu|deb|fc|suse)'; }; then
    echo "UNKNOWN - version appears older than upstream fix, but distro backport status was not proven"
    echo "xorg_pkg='${xorg_pkg_info:-none}' xwayland_pkg='${xwayland_pkg_info:-none}' root_xorg=$root_xorg root_xwayland=$root_xwayland"
    exit 2
  else
    echo "VULNERABLE - upstream version older than fixed release"
    echo "xorg_version=${xorg_ver:-none} xwayland_version=${xwayland_ver:-none} fixed_xorg=$FIX_XORG fixed_xwayland=$FIX_XWAYLAND root_xorg=$root_xorg root_xwayland=$root_xwayland"
    exit 1
  fi
fi

echo "PATCHED - detected versions meet or exceed upstream fixed releases"
echo "xorg_version=${xorg_ver:-none} xwayland_version=${xwayland_ver:-none} root_xorg=$root_xorg root_xwayland=$root_xwayland"
exit 0