Every CVE Search/ Get API key

CVE-2026-40393

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU...

8.1 HighFix available

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.43%Up 0.4 points since Apr 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Record
CVE-2026-40393
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-21737 8.1

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Record
EUVD-2026-21737
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-w54f-pw7x-c532 8.1

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU...

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Record
GHSA-w54f-pw7x-c532
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 8.1

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Record
CVE-2026-40393
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVBELL-CVE-2026-40393 9.8
Record
BELL-CVE-2026-40393
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-40393 9.8

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Record
DEBIAN-CVE-2026-40393
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 22 moreShow less
OSVOESA-2026-2048 9.8

mesa security update

.

Security Fix(es):

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)

Record
OESA-2026-2048
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2049 9.8

mesa security update

.

Security Fix(es):

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)

Record
OESA-2026-2049
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2050 9.8

mesa security update

.

Security Fix(es):

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)

Record
OESA-2026-2050
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2051 9.8

mesa security update

.

Security Fix(es):

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)

Record
OESA-2026-2051
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2052 9.8

mesa security update

.

Security Fix(es):

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.(CVE-2026-40393)

Record
OESA-2026-2052
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-40393 9.8

CVE-2026-40393 in mesa - Patched by Root

Root has patched CVE-2026-40393 in the mesa package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-40393
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-40393 9.8

CVE-2026-40393 in rootio-mesa - Patched by Root

Root has patched CVE-2026-40393 in the rootio-mesa package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-40393
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-40393 9.8

CVE-2026-40393 in rootio-mesa - Patched by Root

Root has patched CVE-2026-40393 in the rootio-mesa package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-40393
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-40393 8.1

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Record
UBUNTU-CVE-2026-40393
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-82688 No score

CVE-2026-40393 affecting package mesa for versions less than 24.0.1-8

In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Record
AZL-82688
Updated
2026-11-05
OSVCLSA-2026-1787314086 No score

Fix CVE(s): CVE-2026-40393

  • SECURITY UPDATE: out-of-bounds memory access from an unbounded stack allocation in the SPIR-V front end (ELSCVE-171724)
    • debian/patches/backport-STACK_ARRAY.patch: add the upstream src/util/stack_array.h helper, which the fix requires.
    • debian/patches/CVE-2026-40393.patch: replace NIR_VLA, a bare alloca, with STACK_ARRAY at the two sites whose element count comes from the shader, in src/compiler/spirv/spirv_to_nir.c and src/compiler/nir/nir_inline_functions.c.
    • CVE-2026-40393
Record
CLSA-2026-1787314086
Updated
2026-11-02
OSVopenSUSE-SU-2026:20688-1 No score

Security update for Mesa

This update for Mesa fixes the following issue:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
openSUSE-SU-2026:20688-1
Updated
2026-11-02
OSVSUSE-SU-2026:1343-1 No score

Security update for Mesa

This update for Mesa fixes the following issue:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
SUSE-SU-2026:1343-1
Updated
2026-11-02
OSVSUSE-SU-2026:1835-1 No score

Security update for Mesa

This update for Mesa fixes the following issue:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
SUSE-SU-2026:1835-1
Updated
2026-11-02
OSVSUSE-SU-2026:1839-1 No score

Security update for Mesa

This update for Mesa fixes the following issue:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
SUSE-SU-2026:1839-1
Updated
2026-11-02
OSVSUSE-SU-2026:1844-1 No score

Security update for Mesa

This update for Mesa fixes the following issue:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
SUSE-SU-2026:1844-1
Updated
2026-11-02
OSVSUSE-SU-2026:1845-1 No score

Security update for Mesa

This update for Mesa fixes the following issue:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
SUSE-SU-2026:1845-1
Updated
2026-11-02
OSVSUSE-SU-2026:21292-1 No score

Security update for Mesa

This update for Mesa fixes the following issue:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
SUSE-SU-2026:21292-1
Updated
2026-11-02
OSVSUSE-SU-2026:21412-1 No score

Security update for Mesa

This update for Mesa fixes the following issues:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
SUSE-SU-2026:21412-1
Updated
2026-11-02
OSVSUSE-SU-2026:21534-1 No score

Security update for Mesa

This update for Mesa fixes the following issue:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
SUSE-SU-2026:21534-1
Updated
2026-11-02
OSVSUSE-SU-2026:21564-1 No score

Security update for Mesa

This update for Mesa fixes the following issue:

  • CVE-2026-40393: out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party (bsc#1261998).
Record
SUSE-SU-2026:21564-1
Updated
2026-11-02
OSVUSN-8427-1 No score

mesa vulnerability

It was discovered that Mesa did not properly validate memory allocation sizes in WebGPU under certain circumstances. An attacker could use this issue to cause Mesa to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-8427-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mesa
Azure Linux:3
 before 24.0.1-8
24.0.1-8
mesa
Alpaquita:stream
 23.1.3-r4 up to 26.0.1-r0
26.0.1-r0
libd3dadapter9-mesa
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libd3dadapter9-mesa-dev
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libegl-mesa0
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libegl1-mesa
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libegl1-mesa-dev
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libgbm-dev
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libgbm1
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libgl1-mesa-dev
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
Show 32 moreShow less
Affected packages
PackageAffectedFixed
libgl1-mesa-dri
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libgl1-mesa-glx
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libglapi-mesa
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libgles2-mesa
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libgles2-mesa-dev
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libglx-mesa0
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libosmesa6
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libosmesa6-dev
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libwayland-egl1-mesa
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libxatracker-dev
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
libxatracker2
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
mesa-common-dev
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
mesa-opencl-icd
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
mesa-va-drivers
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
mesa-vdpau-drivers
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
mesa-vulkan-drivers
TuxCare:Ubuntu:18.04
 before 20.0.8-0ubuntu1~18.04.1+tuxcare.els1
20.0.8-0ubuntu1~18.04.1+tuxcare.els1
mesa
Debian:12
 before 22.3.6-1+deb12u2, plus listed versions
22.3.6-1+deb12u1
22.3.6-1+deb12u2
mesa
Debian:13
 before 25.0.7-2+deb13u1, plus listed versions
25.0.7-2
25.0.7-2+deb13u1
mesa
Debian:14
 before 26.0.1-1, plus listed versions
25.0.7-225.1.0-125.1.5-125.1.7-125.2.0-1
Show 24 moreShow less
25.2.1-125.2.1-225.2.2-125.2.3-125.2.3-1~bpo13+125.2.4-125.2.4-1~bpo13+125.2.4-1~bpo13+225.2.5-125.2.6-125.2.6-1~bpo13+125.2.7-125.2.8-125.2.8-225.3.0-125.3.0~rc1-125.3.0~rc2-125.3.0~rc4-125.3.1-125.3.2-125.3.2-225.3.3-126.0.0-126.0.0~rc3-1
26.0.1-1
mesa
openEuler:24.03-LTS-SP1
 before 24.0.3-5.oe2403sp1
24.0.3-5.oe2403sp1
mesa
openEuler:24.03-LTS-SP3
 before 24.0.3-5.oe2403sp3
24.0.3-5.oe2403sp3
mesa
openEuler:20.03-LTS-SP4
 before 20.1.4-4.oe2003sp4
20.1.4-4.oe2003sp4
mesa
openEuler:22.03-LTS-SP4
 before 21.3.1-7.oe2203sp4
21.3.1-7.oe2203sp4
mesa
openEuler:24.03-LTS
 before 24.0.3-5.oe2403
24.0.3-5.oe2403
Mesa
SUSE:Linux Enterprise Micro 5.2
 before 20.2.4-150300.59.12.1
20.2.4-150300.59.12.1
mesa
Ubuntu:14.04:LTS
 All versions, plus listed versions
9.2.1-1ubuntu39.2.2-1ubuntu19.2.2-1ubuntu210.0.0-1ubuntu210.0.0-1ubuntu3
Show 19 moreShow less
10.0.0-1ubuntu410.0.1-1ubuntu210.1.0~rc1-1ubuntu110.1.0~rc1-1ubuntu310.1.0~rc1-1ubuntu410.1.0~rc3-0ubuntu110.1.0~rc3-0ubuntu210.1.0~rc3-0ubuntu310.1.0-1ubuntu110.1.0-4ubuntu110.1.0-4ubuntu210.1.0-4ubuntu410.1.0-4ubuntu510.1.3-0ubuntu0.110.1.3-0ubuntu0.210.1.3-0ubuntu0.310.1.3-0ubuntu0.410.1.3-0ubuntu0.510.1.3-0ubuntu0.6
 None known
mesa
Ubuntu:16.04:LTS
 All versions, plus listed versions
11.0.2-1ubuntu411.0.4-1ubuntu111.0.5-1ubuntu111.0.5-1ubuntu211.0.6-1ubuntu1
Show 16 moreShow less
11.0.7-1ubuntu111.0.8-1ubuntu111.1.1-1ubuntu211.1.2-1ubuntu111.1.2-1ubuntu211.2.0-1ubuntu111.2.0-1ubuntu211.2.0-1ubuntu2.111.2.0-1ubuntu2.212.0.6-0ubuntu0.16.04.117.0.7-0ubuntu0.16.04.117.0.7-0ubuntu0.16.04.217.2.4-0ubuntu1~16.04.217.2.4-0ubuntu1~16.04.417.2.8-0ubuntu0~16.04.118.0.5-0ubuntu0~16.04.1
 None known
mesa
Ubuntu:18.04:LTS
 All versions, plus listed versions
17.2.2-0ubuntu117.2.4-0ubuntu217.3.3-0ubuntu118.0.0~rc4-1ubuntu318.0.0~rc5-1ubuntu1
Show 14 moreShow less
18.0.5-0ubuntu0~18.04.118.2.2-0ubuntu1~18.04.118.2.2-0ubuntu1~18.04.218.2.8-0ubuntu0~18.04.219.0.2-1ubuntu1.1~18.04.119.0.2-1ubuntu1.1~18.04.219.0.8-0ubuntu0~18.04.119.0.8-0ubuntu0~18.04.219.0.8-0ubuntu0~18.04.319.2.1-1ubuntu1~18.04.119.2.8-0ubuntu0~18.04.119.2.8-0ubuntu0~18.04.219.2.8-0ubuntu0~18.04.320.0.8-0ubuntu1~18.04.1
 None known
mesa
Ubuntu:20.04:LTS
 All versions, plus listed versions
19.2.1-1ubuntu119.2.4-1ubuntu119.3.3-1ubuntu120.0.0-1ubuntu120.0.2-1ubuntu1
Show 12 moreShow less
20.0.4-1ubuntu120.0.4-2ubuntu120.0.8-0ubuntu1~20.04.120.2.6-0ubuntu0.20.04.121.0.3-0ubuntu0.2~20.04.121.0.3-0ubuntu0.3~20.04.121.0.3-0ubuntu0.3~20.04.221.0.3-0ubuntu0.3~20.04.321.0.3-0ubuntu0.3~20.04.421.0.3-0ubuntu0.3~20.04.521.2.6-0ubuntu0.1~20.04.121.2.6-0ubuntu0.1~20.04.2
 None known
mesa
Ubuntu:22.04:LTS
 before 23.2.1-1ubuntu3.1~22.04.4, plus listed versions
21.2.2-1ubuntu121.3.5-1ubuntu122.0.0-0ubuntu222.0.1-1ubuntu122.0.1-1ubuntu2
Show 9 moreShow less
22.0.1-1ubuntu2.122.0.5-0ubuntu0.122.0.5-0ubuntu0.322.2.5-0ubuntu0.1~22.04.122.2.5-0ubuntu0.1~22.04.222.2.5-0ubuntu0.1~22.04.323.0.4-0ubuntu1~22.04.123.2.1-1ubuntu3.1~22.04.223.2.1-1ubuntu3.1~22.04.3
23.2.1-1ubuntu3.1~22.04.4
mesa
Ubuntu:24.04:LTS
 before 25.2.8-0ubuntu0.24.04.2, plus listed versions
23.2.1-1ubuntu323.2.1-1ubuntu423.3.0-2ubuntu323.3.3-1ubuntu224.0.1-1ubuntu1
Show 10 moreShow less
24.0.3-1ubuntu324.0.3-1ubuntu424.0.5-1ubuntu124.0.9-0ubuntu0.124.0.9-0ubuntu0.224.0.9-0ubuntu0.324.2.8-1ubuntu1~24.04.125.0.7-0ubuntu0.24.04.125.0.7-0ubuntu0.24.04.225.2.8-0ubuntu0.24.04.1
25.2.8-0ubuntu0.24.04.2
mesa
Ubuntu:25.10
 before 25.2.8-0ubuntu0.25.10.2, plus listed versions
25.0.3-1ubuntu225.0.7-0ubuntu125.0.7-0ubuntu225.0.7-0ubuntu325.1.5-1ubuntu1
Show 5 moreShow less
25.1.7-1ubuntu125.2.1-2ubuntu125.2.2-1ubuntu125.2.3-1ubuntu125.2.8-0ubuntu0.25.10.1
25.2.8-0ubuntu0.25.10.2

History

History
RecordedChangedSources
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40393 is a high vulnerability (CVSS 8.1) in Mesa3d Mesa, published April 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in mesa 24.0.1-8.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open