diff --git a/debian/changelog b/debian/changelog
index cdbc49b93a04949609adaa02393842a37b930877..d30d207679da26b4ad6d5380c222651deca7395a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+xorg-server (2:21.1.7-3+deb12u8) bookworm-security; urgency=high
+
+ * Non-maintainer upload by the Security Team.
+ * xkb: Fix buffer overflow in _XkbSetCompatMap() (CVE-2024-9632)
+
+ -- Salvatore Bonaccorso <carnil@debian.org> Sat, 26 Oct 2024 13:08:33 +0200
+
xorg-server (2:21.1.7-3+deb12u7+apertis0) apertis; urgency=medium
* Sync from debian/bookworm-security.
diff --git a/debian/patches/series b/debian/patches/series
index 4b734ce11386a85fc6fb16d075cdeee9c702c99f..5008b208db156b2b3aa6509ee6481d403c2fedd4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -23,3 +23,4 @@ dix-Fix-use-after-free-in-input-device-shutdown.patch
05_Revert-Unload-submodules.diff
06_use-intel-only-on-pre-gen4.diff
07_use-modesetting-driver-by-default-on-GeForce.diff
+xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch
diff --git a/debian/patches/xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch b/debian/patches/xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch
new file mode 100644
index 0000000000000000000000000000000000000000..8ee797f6bf35733fa908d3630140a3f2e0e54347
--- /dev/null
+++ b/debian/patches/xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch
@@ -0,0 +1,54 @@
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Thu, 10 Oct 2024 10:37:28 +0200
+Subject: xkb: Fix buffer overflow in _XkbSetCompatMap()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-9632
+
+The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
+buffer.
+
+However, It didn't update its size properly. It updated `num_si` only,
+without updating `size_si`.
+
+This may lead to local privilege escalation if the server is run as root
+or remote code execution (e.g. x11 over ssh).
+
+CVE-2024-9632, ZDI-CAN-24756
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: José Expósito <jexposit@redhat.com>
+---
+ xkb/xkb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index bd44a2094f82..6b072087bec4 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -2989,13 +2989,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
+ XkbSymInterpretPtr sym;
+ unsigned int skipped = 0;
+
+- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
+- compat->num_si = req->firstSI + req->nSI;
++ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
++ compat->num_si = compat->size_si = req->firstSI + req->nSI;
+ compat->sym_interpret = reallocarray(compat->sym_interpret,
+- compat->num_si,
++ compat->size_si,
+ sizeof(XkbSymInterpretRec));
+ if (!compat->sym_interpret) {
+- compat->num_si = 0;
++ compat->num_si = compat->size_si = 0;
+ return BadAlloc;
+ }
+ }
+--
+2.45.2
+