Re: Question regarding the WebGPU security fix in Mesa 26.0.1 / 25.3.6

Camila Camargo de Matos <[email protected]> Tue, 3 Mar 2026 08:57:36 -0300
Newsgroups	gmane.comp.video.mesa3d.devel
Message-ID	<[email protected]>
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------0eJupwX0BF8ZD0FVBOCe27S8
Content-Type: multipart/mixed; boundary="------------5g0oO5rt2eVWSkPXyL53y0h0";
 protected-headers="v1"
From: Camila Camargo de Matos <[email protected]>
To: Eric Engestrom <[email protected]>, [email protected]
Cc: security-team <[email protected]>
Message-ID: <[email protected]>
Subject: Re: Question regarding the WebGPU security fix in Mesa 26.0.1 /
 25.3.6
References: <[email protected]>
 <[email protected]>
In-Reply-To: <[email protected]>

--------------5g0oO5rt2eVWSkPXyL53y0h0
Content-Type: multipart/alternative;
 boundary="------------8uYC00ZWmrkGtmPPfEPE4k0U"

--------------8uYC00ZWmrkGtmPPfEPE4k0U
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

SGVsbG8sIEVyaWMgYW5kIE1lc2EgdGVhbS4NCg0KT24gMi8yNy8yNiAxOTo0NSwgRXJpYyBF
bmdlc3Ryb20gd3JvdGU6DQo+IFRoYXQncyBjb3JyZWN0LiBJIGd1ZXNzIEkgd2FzIGhvcGlu
ZyB0aGF0IHJhdGhlciB0aGFuIGJhY2twb3J0aW5nIGEgaGFuZGZ1bCBvZiBjb21taXRzLCBw
YWNrYWdlcnMgd291bGQgYWxsIHVwZGF0ZSB0byB0aGUgbGFzdCByZWxlYXNlIGN5Y2xlIChv
ciB0aGUgb25lIGJlZm9yZSB0aGF0KSwgYnV0IHllcywgdGhlIHR3byBjb21taXRzIGluIHRo
YXQgTVIgYXJlIHRoZSBmaXggZm9yIHRoYXQgcGFydGljdWxhciBpc3N1ZSA6KQ0KVGhhbmsg
eW91IHZlcnkgbXVjaCBmb3IgdGhlIHF1aWNrIHJlc3BvbnNlIGFuZCBjb25maXJtYXRpb24g
b2YgdGhlIA0KZml4aW5nIGNvbW1pdHMhDQoNCkNvbnNpZGVyaW5nIHRoYXQgdGhpcyBmaXgg
aXMgYWRkcmVzc2luZyBhIHJlbGV2YW50IHNlY3VyaXR5IGlzc3VlLCB3aGljaCANCndhcyBy
ZXBvcnRlZCBhcyBiZWluZyAiWy4uLl0gcmF0aGVyIHByZXNzaW5nIGR1ZSB0byB0aGUgV2Vi
R1BVIGV4cG9zdXJlIA0KaW4gbW9kZXJuIHdlYiBicm93c2VycyIsIGhhcyB0aGUgTWVzYSB0
ZWFtIGNvbnNpZGVyZWQgdGhlIHBvc3NpYmlsaXR5IG9mIA0KYXNzaWduaW5nIGEgQ1ZFIElE
IGZvciB0aGUgaXNzdWU/DQoNCkkgYXNrLCBiZWNhdXNlIHdlIHdhbnQgdG8gZW5zdXJlIHRo
aXMgY2FuIGJlIHByb3Blcmx5IHRyYWNrZWQuIElmIHlvdSANCnRoaW5rIHRoYXQgYSBDVkUg
aXMgd2FycmFudGVkIGluIHRoaXMgY2FzZSwgd2UsIHRoZSBTVVNFIFNlY3VyaXR5IHRlYW0q
LCANCipjYW4gbWFrZSB0aGUgcmVxdWVzdMKgdG8gc2F2ZSB5b3UgdGhlIG92ZXJoZWFkLg0K
DQpQbGVhc2UgbGV0IHVzIGtub3cgaWYgeW914oCZZCBsaWtlIHVzIHRvIHByb2NlZWQgdGhp
cyB3YXkuIFRoYW5rcyBpbiBhZHZhbmNlIQ0KDQpSZWdhcmRzLA0KDQotLSANCkNhbWlsYSBD
YW1hcmdvIGRlIE1hdG9zDQpTZWN1cml0eSBFbmdpbmVlciBAIFNVU0UgU29mdHdhcmUgU29s
dXRpb25zDQpHUEc6IEI5REYgMEYwMyAwNjQwIEU3ODAgNkI0NyBFNjBFIEJGMzYgQkRFOSBE
MDM0IDMwRDENCg0K
--------------8uYC00ZWmrkGtmPPfEPE4k0U
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
  </head>
  <body>
    <div class=3D"moz-cite-prefix">Hello, Eric and Mesa team.<br>
      <br>
      On 2/27/26 19:45, Eric Engestrom wrote:<br>
    </div>
    <blockquote type=3D"cite"
      cite=3D"mid:[email protected]">=

      <pre wrap=3D"" class=3D"moz-quote-pre">That's correct. I guess I wa=
s hoping that rather than backporting a handful of commits, packagers wou=
ld all update to the last release cycle (or the one before that), but yes=
, the two commits in that MR are the fix for that particular issue :)
</pre>
    </blockquote>
    Thank you very much for the quick response and confirmation of the
    fixing commits!<br>
    <br>
    Considering that this fix is addressing a relevant security issue,
    which was reported as being "[...] rather pressing due to the WebGPU
    exposure in modern web browsers", has the Mesa team considered the
    possibility of assigning a CVE ID for the issue?=C2=A0<br>
    <br>
    I ask, because we want to ensure this can be properly tracked. If
    you think that a CVE is warranted in this case, we, the=C2=A0<span
      data-path-to-node=3D"8" data-index-in-node=3D"111">SUSE Security te=
am<b>,=C2=A0</b>can
      make the request</span>=C2=A0to save you the overhead.
    <p data-path-to-node=3D"9">Please let us know if you=E2=80=99d like u=
s to
      proceed this way. Thanks in advance!</p>
    Regards,
    <pre class=3D"moz-signature" cols=3D"72">--=20
Camila Camargo de Matos
Security Engineer @ SUSE Software Solutions
GPG: B9DF 0F03 0640 E780 6B47 E60E BF36 BDE9 D034 30D1</pre>
  </body>
</html>

--------------8uYC00ZWmrkGtmPPfEPE4k0U--

--------------5g0oO5rt2eVWSkPXyL53y0h0--

--------------0eJupwX0BF8ZD0FVBOCe27S8
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKgfuC1XqvyVMOyRhP/dL5hYHRZgFAmmmzLEACgkQP/dL5hYH
RZjWAQ/7B9c1wSrNfbAb8/A4gyLBD8VYIDNkmBvdrORaIvDgbysZwXlC3Im3N/C8
cE61NJvrV+VD0s39v0+ORCi8Foj59S7afXwmJACpyJfJg9Dl1/D2ovfxEsbZ6pnz
9+piVeIdlUi+6z8vzaS3Ppn7WXRxTscEGOs+0g1tKiKwcbOM5DriTuDoSNkOg5y4
+AsuBOHaaEDI9IioeOjWoDz05WKulHAJblCGY0WIJPwKHEs44CLwAkDYYmMyUitD
vqlYSOqyEBJGR/UIrnn5YYTX7zOFG4bEkiPSWJY5d4iBgIWn09fDdyzf08InIpNo
7qhYLjGi0MtpFHK0kG1MAjfzoq158t2cYxxxZeCVB6rakik2udMpAlg89/vv9BD2
wg0IycLtXc6w1VwC9UyBMwX/GrXkHeH/imx+rOQCXxE3aHPiLbYDQyuFaNZp7gT1
L7f5MLXyM9zxtkkMOz00Ehjg8MBtu7hMtU3rMpnq9WtrDcbWbEpsYqhu2msYmUdw
roIle7Q8w2pJ/3zsoj/p4ZaMw0xBUG6t1no0GBUZTIVkHjMwXrSyriDRy3oEeMXD
vWCFEcOClh0M/OQWsktL8UUn++moISnHx0a7BoY0U7csI7lk0GdhgxRGs47l0brm
W7wNlV36qb8xZj5U0eI3M7zACD/KlI4NJ0H5VXZVyAoiZq0NvGk=
=6Wrr
-----END PGP SIGNATURE-----

--------------0eJupwX0BF8ZD0FVBOCe27S8--