Brief Summary: Mesa 3D Graphics Library CVE-2026-40393, Out of Bounds Write via WebGPU Shader Input

Introduction

A memory corruption flaw in Mesa's WebGPU shader compiler lets a remote attacker trigger an out-of-bounds write simply by serving a crafted web page to a Linux user. Mesa is the default graphics driver stack on virtually every Linux distribution, so this vulnerability affects a large installed base of desktops, workstations, and embedded devices running browsers with WebGPU support.

Technical Information

Root Cause

The vulnerability is in Mesa's NIR (New Intermediate Representation) compiler, in the code that handles function calls and memory allocation during shader processing. In affected versions, the field count that determines the size of a stack allocation comes directly from the shader. Shaders processed through WebGPU come from untrusted web content, so an attacker-controlled value decides how much memory alloca allocates.

The alloca function allocates memory on the stack rather than the heap. When a shader supplies a large enough field count, the resulting alloca call overflows the stack frame and memory access goes out of bounds. The weakness is classified as CWE 787 (Out of bounds Write).

The flaw was introduced by accident in commit c11833ab, which reworked function calls. The fix in commit 9017d37e replaced NIR_VLA (a variable-length array macro) with STACK_ARRAY, which puts safe bounds on the allocation size.

Attack Flow

The attack is straightforward and needs no authentication or special privileges:

1. An attacker crafts a WebGPU shader containing an excessively large field count value.
2. The attacker hosts this shader on a malicious web page or injects it into a compromised site.
3. A victim on a Linux system with a vulnerable Mesa version opens the page in a browser with WebGPU enabled.
4. The browser passes the shader to Mesa's NIR compiler for processing.
5. The compiler reads the attacker-controlled field count and uses it as the size argument for an alloca call.
6. The oversized stack allocation causes out-of-bounds memory access, which may let the attacker corrupt adjacent stack memory.

The CVSS 3.1 base score of 8.1 (High) accounts for remote exploitation through the browser and the potential for significant impact from memory corruption.

Affected Systems and Versions

The following Mesa versions are affected:

Any Linux distribution or embedded platform (including ChromeOS) that ships these Mesa versions with a WebGPU-capable browser is potentially affected. Organizations should check the exact Mesa version installed on their systems and confirm that downstream distribution packages have integrated the fix.

Vendor Security History

Mesa is an open-source project hosted by freedesktop.org. It provides OpenGL, Vulkan, and now WebGPU implementations for Linux. As the primary GPU driver stack across desktop Linux, Wayland compositors, and embedded platforms like ChromeOS, it is a high-value target. The project keeps an active release calendar and responded quickly to this disclosure, shipping fixes within weeks of the report. ChromeOS has already cherry-picked the relevant commit to secure its environment.

References

• NVD: CVE-2026-40393
• CVE Record: CVE-2026-40393
• Mesa Merge Request 39866
• Mesa 26.0.1 Announcement
• Fix Commit: nir: Use STACK_ARRAY instead of NIR_VLA (9017d37e)
• Introducing Commit: nir,spirv: Rework function calls (c11833ab)
• Mesa 25.3.6 Release Notes
• Mesa 26.0.1 Release Notes
• Phoronix: Mesa 26.0.1 Released With Important Security Fix
• Mesa Dev Discussion on WebGPU Security Fix
• Mesa 3D Graphics Library