Xorg Server 26.1.0 RC2 Lands with Security Hardening and ABI Bumps
The second release candidate for the standalone X server is here. Xorg Server 26.0.99.902, also known as 26.1.0 RC2, dropped today. Alan Coopersmith of Oracle Solaris Engineering announced the release alongside a simultaneous launch of Xwayland RC2.
RC1 hit the mailing lists on August 19, giving the community roughly three weeks to test the 26.1 codebase before this version. The branch point itself went up on August 12, 2026. The current stable branch remains xorg-server-21.1, so if you're running that, your system is unaffected.
ABI Bumps and Security Fixes
Keep in mind that this release breaks backward compatibility. Both ABI_VIDEODRV_VERSION and ABI_EXTENSION_VERSION have been bumped significantly. The video driver ABI is now 28.0, and the extension ABI is at 11.0. Video drivers and X extensions built against older server versions will not load. Packagers need to rebuild everything against this code.
ABI bumps of this magnitude are never a smooth transition for distro maintainers. If you're a maintainer, start your rebuild cycles now.
Security got a dose of hardening from Olivier Fourdan. Two patches add request length bounds checking for SwapLongs of resolution values in the X Input extension. These guard against potential buffer over-reads triggered by malformed requests. A regression test accompanies the fix, covering the specific vulnerability class. The X protocol parser has historically been a source of CVEs, so this kind of input validation is welcome.
Jeremy Huddleston Sequoia leads the contributor list with eight patches. His work covers XKB keymap hardening against malformed input, a double free fix in RegionValidate, and cleanup for the rootless XQuartz build on macOS.
Lukáš Lipinský of SUSE contributed four patches focused on byte-swapping fixes for big-endian architectures like PowerPC. Scroll valuators and device change events were previously mishandled on those systems, causing broken mouse and scroll behavior. On top of that, Jeremy's XKB patches include four commits that guard against keymaps with no groups or invalid group counts. These prevent undefined behavior when the server encounters unusual keymap data.
Gaming users might spot a small tweak for Proton compatibility. A patch in the KDrive/Ephyr component reports a dummy refresh rate through RandR. Valve's Proton 8 or later requires a valid refresh rate from the server. This ensures the X server continues to work smoothly for Steam Deck and PC gamers using the compatibility layer. It's a niche fix, but it keeps the X server relevant for gaming as Proton evolves.
Ben Song fixed a cursor display issue in master/slave sprite configurations, while Daniel Monteiro made a failed GPU screen init non-fatal. The latter change prevents the server from aborting entirely if one GPU screen fails to initialize. Quality of life improvement for multi-GPU setups.
The build system is strictly meson now. autoconf and automake support was removed earlier in the 26.x cycle. Alan Coopersmith tightened meson to only install dri3.h when building dri3 support and switched to cpu_family() for architecture detection during cross-compilation.
You can grab the source from the official archive. Head here to the source archive if you want to pull the release yourself.
This release is part of the broader standalone server effort that began in the 26.x series. The overlap between xorg-server and Xwayland commits confirms the two projects are now maintained in lockstep. RC2 is the code to test before the final 26.1.0 lands. Issues and patches continue to flow through GitLab.
