The XI2 passive ungrab path (XIPassiveUngrabDevice) is missing the modifier validation that exists in the grab path and in legacy XI paths. Without checking against AllModifiersMask, a client can supply out-of-range modifier values that lead to an out-of-bounds write when the modifier is used as an index.

An authenticated X client can trigger this by sending an XIPassiveUngrabDevice request with an out-of-range modifier value.
The out-of-bounds write can lead to arbitrary code execution or denial of service.

NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-server-21.1.25)