CVE-2026-40393
mesa: In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-...
CVE-2026-40393 is fixed in 45 products on 1 platform, first by libd3dadapter9-mesa 23.2.1-1ubuntu3.1~22.04.4, released April 12, 2026. It is not reported as exploited. Patch Radar priority: Urgent.
Urgent
CVSS
9.8
critical
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0043
37th percentile
In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libd3dadapter9-mesa · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | libd3dadapter9-mesa 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| libegl-mesa0 · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | libegl-mesa0 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| libegl-mesa0 · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | libegl-mesa0 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| libegl-mesa0 · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | libegl-mesa0 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| libgbm1 · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | libgbm1 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| libgbm1 · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | libgbm1 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| libgbm1 · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | libgbm1 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| libgl1-mesa-dri · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | libgl1-mesa-dri 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| libgl1-mesa-dri · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | libgl1-mesa-dri 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| libgl1-mesa-dri · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | libgl1-mesa-dri 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| libglapi-mesa · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | libglapi-mesa 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| libglx-mesa0 · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | libglx-mesa0 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| libglx-mesa0 · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | libglx-mesa0 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| libglx-mesa0 · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | libglx-mesa0 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| libosmesa6 · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | libosmesa6 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| libxatracker2 · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | libxatracker2 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| mesa · Debian 12.15 (bookworm) | 22.3.6-1+deb12u2 | DEBIAN-CVE-2026-40393 | Apr 12, 2026 |
| mesa · Debian 13.5 (trixie) | 25.0.7-2+deb13u1 | DEBIAN-CVE-2026-40393 | Apr 12, 2026 |
| mesa · Debian 14 | 26.0.1-1 | DEBIAN-CVE-2026-40393 | Apr 12, 2026 |
| mesa-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-debugsource · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-dri-drivers · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-dri-drivers-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-drm-shim · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | mesa-drm-shim 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| mesa-drm-shim · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | mesa-drm-shim 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| mesa-drm-shim · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | mesa-drm-shim 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| mesa-filesystem · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libEGL · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libEGL-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libEGL-devel · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libGL · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libGL-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libGL-devel · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libOSMesa · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libOSMesa-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libOSMesa-devel · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libOpenCL · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libOpenCL-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libOpenCL-devel · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libd3d · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libd3d-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libd3d-devel · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libgallium · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | mesa-libgallium 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| mesa-libgallium · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | mesa-libgallium 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| mesa-libgbm · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libgbm-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libgbm-devel · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libglapi · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libglapi-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libxatracker · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libxatracker-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-libxatracker-devel · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-opencl-icd · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | mesa-opencl-icd 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| mesa-opencl-icd · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | mesa-opencl-icd 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| mesa-opencl-icd · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | mesa-opencl-icd 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| mesa-teflon-delegate · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | mesa-teflon-delegate 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| mesa-teflon-delegate · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | mesa-teflon-delegate 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| mesa-va-drivers · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | mesa-va-drivers 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| mesa-va-drivers · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | mesa-va-drivers 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| mesa-va-drivers · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | mesa-va-drivers 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| mesa-va-drivers · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-vdpau-drivers · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | mesa-vdpau-drivers 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| mesa-vdpau-drivers · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | mesa-vdpau-drivers 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| mesa-vdpau-drivers · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | mesa-vdpau-drivers 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| mesa-vdpau-drivers · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-vulkan-drivers · Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | mesa-vulkan-drivers 23.2.1-1ubuntu3.1~22.04.4 | Apr 12, 2026 |
| mesa-vulkan-drivers · Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | mesa-vulkan-drivers 25.2.8-0ubuntu0.24.04.2 | Apr 12, 2026 |
| mesa-vulkan-drivers · Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | mesa-vulkan-drivers 25.2.8-0ubuntu0.25.10.2 | Apr 12, 2026 |
| mesa-vulkan-drivers · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
| mesa-vulkan-drivers-debuginfo · amzn 2023 | 24.2.6-1268.amzn2023.0.1 | ALAS2023-2026-1623 | Apr 27, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.