Executive brief
Mesa is a widely used open-source graphics library that provides the foundation for 3D rendering on Linux and other systems. A vulnerability in its WebGPU component could allow an attacker to cause memory corruption by providing specially crafted shader data. This could lead to system instability, service crashes, or potentially unauthorized access to sensitive information.
Technical details
An out-of-bounds memory access vulnerability exists in Mesa's WebGPU implementation within the SPIR-V to NIR translation layer. The root cause is the use of 'alloca' (via NIR_VLA) with an allocation size determined by untrusted shader data, such as the number of fields or parameters. An attacker can provide a specially crafted shader with a large number of fields to trigger a stack-based buffer overflow or out-of-bounds access. This is reachable over the network if an application exposes WebGPU functionality to untrusted content. The issue is fixed by replacing variable-length arrays (VLA) with heap-based STACK_ARRAY allocations in Mesa versions 25.3.6 and 26.0.1.
Affected products
- Mesa3D Mesa before 25.3.6, 26.0.0 before 26.0.1
Timeline
- 2026-02-12: patched: Merge request for fix submitted to Mesa GitLab
- 2026-02-25: advisory: Mesa 26.0.1 and 25.3.6 release announcements published
- 2026-04-12: disclosed: CVE-2026-40393 published
- 2026-07-13: advisory: Debian LTS advisory DLA-4679-1 published