X.Org X server and Xwayland XKB SetMap stack buffer overflow in _XkbSetMapChecks

#!/usr/bin/env bash
# check-cve-2026-50259.sh
# Detect likely exposure to CVE-2026-50259 on Linux hosts.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_XORG_UPSTREAM="21.1.23"
FIXED_XWAYLAND_UPSTREAM="24.1.12"
STATUS="PATCHED"
DETAILS=()

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

extract_ver() {
  # pull first dotted version from input
  echo "$1" | grep -Eo '[0-9]+(\.[0-9]+){1,3}' | head -n1
}

check_bin() {
  local name="$1"
  local path="$2"
  local fixed="$3"
  local v out

  if [ ! -x "$path" ]; then
    DETAILS+=("$name: not present")
    return 0
  fi

  out="$($path -version 2>/dev/null || $path --version 2>/dev/null || true)"
  v="$(extract_ver "$out")"

  if [ -z "$v" ]; then
    DETAILS+=("$name: version unknown from binary output")
    STATUS="UNKNOWN"
    return 0
  fi

  if ver_ge "$v" "$fixed"; then
    DETAILS+=("$name: binary version $v >= fixed upstream $fixed")
  else
    DETAILS+=("$name: binary version $v < fixed upstream $fixed")
    if [ "$STATUS" != "UNKNOWN" ]; then STATUS="VULNERABLE"; fi
  fi
}

check_dpkg() {
  command -v dpkg-query >/dev/null 2>&1 || return 0
  local pkg ver

  for pkg in xserver-xorg-core xwayland; do
    if dpkg-query -W -f='${Version}' "$pkg" >/dev/null 2>&1; then
      ver="$(dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null)"
      DETAILS+=("dpkg:$pkg=$ver")

      # Known Debian unstable fixed package versions from tracker.
      if [ "$pkg" = "xserver-xorg-core" ]; then
        if dpkg --compare-versions "$ver" ge "2:21.1.23-1"; then
          DETAILS+=("dpkg:$pkg meets Debian unstable fixed threshold")
        else
          DETAILS+=("dpkg:$pkg below Debian unstable fixed threshold; could still be backported later on vendor branches")
          [ "$STATUS" = "PATCHED" ] && STATUS="UNKNOWN"
        fi
      fi

      if [ "$pkg" = "xwayland" ]; then
        if dpkg --compare-versions "$ver" ge "2:24.1.12-1"; then
          DETAILS+=("dpkg:$pkg meets Debian unstable fixed threshold")
        else
          DETAILS+=("dpkg:$pkg below Debian unstable fixed threshold; could still be backported later on vendor branches")
          [ "$STATUS" = "PATCHED" ] && STATUS="UNKNOWN"
        fi
      fi
    fi
  done
}

check_rpm() {
  command -v rpm >/dev/null 2>&1 || return 0
  local pkg
  for pkg in xorg-x11-server-Xorg xorg-x11-server-Xwayland; do
    if rpm -q "$pkg" >/dev/null 2>&1; then
      DETAILS+=("rpm:$pkg=$(rpm -q "$pkg" 2>/dev/null)")
      DETAILS+=("rpm:$pkg installed; vendor backport status must be validated against distro advisory")
      [ "$STATUS" = "PATCHED" ] && STATUS="UNKNOWN"
    fi
  done
}

XORG_PATH="${1:-$(command -v Xorg 2>/dev/null || echo /usr/bin/Xorg)}"
XWAYLAND_PATH="${2:-$(command -v Xwayland 2>/dev/null || echo /usr/bin/Xwayland)}"

check_bin "Xorg" "$XORG_PATH" "$FIXED_XORG_UPSTREAM"
check_bin "Xwayland" "$XWAYLAND_PATH" "$FIXED_XWAYLAND_UPSTREAM"
check_dpkg
check_rpm

# If neither binary exists and no packages were detected, result is PATCHED/NOT APPLICABLE.
# We keep PATCHED to satisfy the required output vocabulary.

echo "$STATUS"
printf '%s
' "${DETAILS[@]}"

case "$STATUS" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac