A vulnerability (CVE-2026-40393, CVSS 8.1 HIGH) in Mesa's WebGPU component allows an attacker to cause a denial of service or potentially execute arbitrary code by exploiting improper validation of memory allocation sizes. The vulnerability affects Mesa versions prior to 25.3.6, as well as version 26.0.0. The fix requires updating affected Ubuntu systems to the specific Mesa package versions listed in the USN and restarting the user session.
Ubuntu Security Notices USN-8427-1 USN-8427-1: Mesa vulnerability Publication date 15 June 2026 Overview Mesa could be made to crash or run programs if it received specially crafted input. Releases 25.10 24.04 LTS 22.04 LTS Open side navigation Close side navigation Packages Details Update instructions References Packages mesa - free implementation of the EGL API Details It was discovered that Mesa did not properly validate memory allocation sizes in WebGPU under certain circumstances. An attacker could use this issue to cause Mesa to crash, resulting in a denial of service, or possibly execute arbitrary code. It was discovered that Mesa did not properly validate memory allocation sizes in WebGPU under certain circumstances. An attacker could use this issue to cause Mesa to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions After a standard system update you need to restart your session to make all the necessary changes. Learn more about how to get the fixes. The problem can be corrected by updating your system to the following package versions: Ubuntu Release Package Version 25.10 questing libegl-mesa0 – 25.2.8-0ubuntu0.25.10.2 libgbm1 – 25.2.8-0ubuntu0.25.10.2 libgl1-mesa-dri – 25.2.8-0ubuntu0.25.10.2 libglx-mesa0 – 25.2.8-0ubuntu0.25.10.2 mesa-drm-shim – 25.2.8-0ubuntu0.25.10.2 mesa-libgallium – 25.2.8-0ubuntu0.25.10.2 mesa-opencl-icd – 25.2.8-0ubuntu0.25.10.2 mesa-teflon-delegate – 25.2.8-0ubuntu0.25.10.2 mesa-va-drivers – 25.2.8-0ubuntu0.25.10.2 mesa-vdpau-drivers – 25.2.8-0ubuntu0.25.10.2 mesa-vulkan-drivers – 25.2.8-0ubuntu0.25.10.2 24.04 LTS noble libegl-mesa0 – 25.2.8-0ubuntu0.24.04.2 libgbm1 – 25.2.8-0ubuntu0.24.04.2 libgl1-mesa-dri – 25.2.8-0ubuntu0.24.04.2 libglx-mesa0 – 25.2.8-0ubuntu0.24.04.2 mesa-drm-shim – 25.2.8-0ubuntu0.24.04.2 mesa-libgallium – 25.2.8-0ubuntu0.24.04.2 mesa-opencl-icd – 25.2.8-0ubuntu0.24.04.2 mesa-teflon-delegate – 25.2.8-0ubuntu0.24.04.2 mesa-va-drivers – 25.2.8-0ubuntu0.24.04.2 mesa-vdpau-drivers – 25.2.8-0ubuntu0.24.04.2 mesa-vulkan-drivers – 25.2.8-0ubuntu0.24.04.2 22.04 LTS jammy libd3dadapter9-mesa – 23.2.1-1ubuntu3.1~22.04.4 libegl-mesa0 – 23.2.1-1ubuntu3.1~22.04.4 libgbm1 – 23.2.1-1ubuntu3.1~22.04.4 libgl1-mesa-dri – 23.2.1-1ubuntu3.1~22.04.4 libglapi-mesa – 23.2.1-1ubuntu3.1~22.04.4 libglx-mesa0 – 23.2.1-1ubuntu3.1~22.04.4 libosmesa6 – 23.2.1-1ubuntu3.1~22.04.4 libxatracker2 – 23.2.1-1ubuntu3.1~22.04.4 mesa-drm-shim – 23.2.1-1ubuntu3.1~22.04.4 mesa-opencl-icd – 23.2.1-1ubuntu3.1~22.04.4 mesa-va-drivers – 23.2.1-1ubuntu3.1~22.04.4 mesa-vdpau-drivers – 23.2.1-1ubuntu3.1~22.04.4 mesa-vulkan-drivers – 23.2.1-1ubuntu3.1~22.04.4 Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines. Get Ubuntu Pro References CVE-2026-40393 CVE-2026-40393