# CVE-2026-40393: mesa: In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-...

CVE-2026-40393 is fixed in 45 products on 1 platform, first by libd3dadapter9-mesa 23.2.1-1ubuntu3.1~22.04.4, released April 12, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-40393
- Priority: Urgent
- CVSS: 9.8 (critical)
- EPSS: 0.0043
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 12, 2026

## Description

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libd3dadapter9-mesa Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [libd3dadapter9-mesa 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libd3dadapter9-mesa-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | libegl-mesa0 Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [libegl-mesa0 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libegl-mesa0-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | libegl-mesa0 Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [libegl-mesa0 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libegl-mesa0-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | libegl-mesa0 Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [libegl-mesa0 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libegl-mesa0-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | libgbm1 Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [libgbm1 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libgbm1-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | libgbm1 Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [libgbm1 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libgbm1-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | libgbm1 Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [libgbm1 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libgbm1-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | libgl1-mesa-dri Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [libgl1-mesa-dri 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libgl1-mesa-dri-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | libgl1-mesa-dri Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [libgl1-mesa-dri 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libgl1-mesa-dri-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | libgl1-mesa-dri Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [libgl1-mesa-dri 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libgl1-mesa-dri-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | libglapi-mesa Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [libglapi-mesa 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libglapi-mesa-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | libglx-mesa0 Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [libglx-mesa0 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libglx-mesa0-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | libglx-mesa0 Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [libglx-mesa0 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libglx-mesa0-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | libglx-mesa0 Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [libglx-mesa0 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libglx-mesa0-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | libosmesa6 Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [libosmesa6 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libosmesa6-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | libxatracker2 Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [libxatracker2 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libxatracker2-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | mesa Debian 12.15 (bookworm) | 22.3.6-1+deb12u2 | [DEBIAN-CVE-2026-40393](https://patchblox.com/security/data/fix/linux/debian-cve-2026-40393.md) | Apr 12, 2026 |
| Linux | mesa Debian 13.5 (trixie) | 25.0.7-2+deb13u1 | [DEBIAN-CVE-2026-40393](https://patchblox.com/security/data/fix/linux/debian-cve-2026-40393.md) | Apr 12, 2026 |
| Linux | mesa Debian 14 | 26.0.1-1 | [DEBIAN-CVE-2026-40393](https://patchblox.com/security/data/fix/linux/debian-cve-2026-40393.md) | Apr 12, 2026 |
| Linux | mesa-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-debugsource amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-dri-drivers amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-dri-drivers-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-drm-shim Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [mesa-drm-shim 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-mesa-drm-shim-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | mesa-drm-shim Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [mesa-drm-shim 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-mesa-drm-shim-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | mesa-drm-shim Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [mesa-drm-shim 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-mesa-drm-shim-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | mesa-filesystem amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libEGL amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libEGL-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libEGL-devel amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libGL amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libGL-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libGL-devel amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libOSMesa amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libOSMesa-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libOSMesa-devel amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libOpenCL amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libOpenCL-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libOpenCL-devel amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libd3d amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libd3d-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libd3d-devel amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libgallium Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [mesa-libgallium 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-mesa-libgallium-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | mesa-libgallium Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [mesa-libgallium 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-mesa-libgallium-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | mesa-libgbm amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libgbm-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libgbm-devel amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libglapi amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libglapi-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libxatracker amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libxatracker-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-libxatracker-devel amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-opencl-icd Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [mesa-opencl-icd 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-mesa-opencl-icd-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | mesa-opencl-icd Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [mesa-opencl-icd 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-mesa-opencl-icd-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | mesa-opencl-icd Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [mesa-opencl-icd 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-mesa-opencl-icd-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | mesa-teflon-delegate Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [mesa-teflon-delegate 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-mesa-teflon-delegate-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | mesa-teflon-delegate Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [mesa-teflon-delegate 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-mesa-teflon-delegate-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | mesa-va-drivers Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [mesa-va-drivers 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-mesa-va-drivers-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | mesa-va-drivers Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [mesa-va-drivers 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-mesa-va-drivers-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | mesa-va-drivers Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [mesa-va-drivers 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-mesa-va-drivers-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | mesa-va-drivers amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-vdpau-drivers Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [mesa-vdpau-drivers 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-mesa-vdpau-drivers-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | mesa-vdpau-drivers Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [mesa-vdpau-drivers 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-mesa-vdpau-drivers-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | mesa-vdpau-drivers Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [mesa-vdpau-drivers 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-mesa-vdpau-drivers-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | mesa-vdpau-drivers amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-vulkan-drivers Ubuntu 22.04.1 LTS (jammy) | 23.2.1-1ubuntu3.1~22.04.4 | [mesa-vulkan-drivers 23.2.1-1ubuntu3.1~22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-mesa-vulkan-drivers-23.2.1-1ubuntu3.1-22.04.4.md) | Apr 12, 2026 |
| Linux | mesa-vulkan-drivers Ubuntu 24.04.5 LTS (noble) | 25.2.8-0ubuntu0.24.04.2 | [mesa-vulkan-drivers 25.2.8-0ubuntu0.24.04.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-mesa-vulkan-drivers-25.2.8-0ubuntu0.24.04.2.md) | Apr 12, 2026 |
| Linux | mesa-vulkan-drivers Ubuntu 25.10 (questing) | 25.2.8-0ubuntu0.25.10.2 | [mesa-vulkan-drivers 25.2.8-0ubuntu0.25.10.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-mesa-vulkan-drivers-25.2.8-0ubuntu0.25.10.2.md) | Apr 12, 2026 |
| Linux | mesa-vulkan-drivers amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |
| Linux | mesa-vulkan-drivers-debuginfo amzn 2023 | 24.2.6-1268.amzn2023.0.1 | [ALAS2023-2026-1623](https://patchblox.com/security/data/fix/linux/alas2023-2026-1623.md) | Apr 27, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.