CheckSetDoodad() in xkb/xkb.c frees doodad->text.text on error but does
not NULL the pointer. When the error path continues, _XkbClearDoodad() is
called during cleanup and frees the same pointer again, resulting in a
double free.
An authenticated X client can trigger this by sending a crafted XkbSetGeometry request with a malformed TextDoodad entry that causes the initial error path to be taken.

The double free can lead to heap corruption, potentially enabling arbitrary code execution or denial of service (crash).

NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-server-21.1.25)