CVE-2026-40393 is an out of bounds memory access flaw in the Mesa graphics library, scored CVSS 8.1. In WebGPU code, the allocation size depends on an untrusted party. Mesa 25.3.6 and 26.0.1 fix it. Update through your distribution. Distributions may backport the fix.
What's affected
From the NVD record:
- Affected: Mesa before 25.3.6, and Mesa 26 before 26.0.1
- Fixed: 25.3.6 and 26.0.1
Debian also published an LTS announcement among the record's references. The Mesa merge request page did not load for my fetch, so the details here come from the record.
How to check if you're exposed
Find your Mesa version. On many Linux systems:
glxinfo | grep "OpenGL version"
or use your package manager:
dpkg -l | grep -i libgl1-mesa
rpm -q mesa-libGL
Distributions often backport fixes without changing the upstream version number, so also read your distribution's security tracker for this CVE and compare the package version it lists.
What to do now
- Apply your distribution updates for Mesa.
- On container images, rebuild from an updated base image.
- Where you cannot update, avoid running untrusted WebGPU content in affected environments, as a stop gap.
- Record which hosts and images contain Mesa so the next review is quick.
Why it matters
The weakness is CWE-787, out of bounds write. The record says the amount of data to allocate is controlled by an untrusted party and then used for stack allocation, which lets a request size the application did not expect cause memory writes outside the intended area.
The CVSS vector is network reachable with high complexity. Graphics libraries process input from web content and from applications, which is why they appear in browser and desktop advisories. The record does not report exploitation in the wild.
Quick check
Does my distribution need the exact upstream version?
Not always. Distributions backport fixes, so use the distribution advisory as the final word on your package.
Sources
Last reviewed: 19 October 2026.
