Re: Question regarding the WebGPU security fix in Mesa 26.0.1 / 25.3.6

Camila Camargo de Matos <[email protected]> Fri, 10 Apr 2026 12:03:20 -0300
Newsgroups gmane.comp.video.mesa3d.devel
Message-ID <[email protected]> 
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------IMCCgT96FYWA3t5W8mn0c0Sc
Content-Type: multipart/mixed; boundary="------------GTQV0rcOmLVuZ0ky1XQmXaje";
 protected-headers="v1"
From: Camila Camargo de Matos <[email protected]>
To: Eric Engestrom <[email protected]>, [email protected]
Message-ID: <[email protected]>
Subject: Re: Question regarding the WebGPU security fix in Mesa 26.0.1 /
 25.3.6
References: <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
In-Reply-To: <[email protected]>

--------------GTQV0rcOmLVuZ0ky1XQmXaje
Content-Type: multipart/alternative;
 boundary="------------UOirIq3gYiRWL0S6A76tPodk"

--------------UOirIq3gYiRWL0S6A76tPodk
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

SGVsbG8gTWVzYSBkZXZlbG9wZXJzLg0KDQpPbiAzLzEyLzI2IDA5OjQ4LCBDYW1pbGEgQ2Ft
YXJnbyBkZSBNYXRvcyB3cm90ZToNCj4gT24gMy83LzI2IDEyOjQ2LCBFcmljIEVuZ2VzdHJv
bSB3cm90ZToNCj4+IEhpIENhbWlsYSwNCj4+DQo+PiBUaGFuayB5b3UgZm9yIG9mZmVyaW5n
ISAgVGhlIHRlYW0gd2hvIGRpc2NvdmVyZWQgYW5kIHJlcG9ydGVkIHRoZSBpc3N1ZSBpcyBu
b3QNCj4+IHlldCBhYmxlIHRvIGdvIHRocm91Z2ggdGhlIENWRSBwcm9jZXNzLCBzbyB3ZSB3
b3VsZCBsb3ZlIHRvIHRha2UgeW91IHVwIG9uDQo+PiB5b3VyIG9mZmVyIHRvIGRvIGl0IGZv
ciB1cy4NCj4+DQo+PiBDaGVlcnMsDQo+PiAgICBFcmljDQo+DQo+IFRoYW5rIHlvdSBmb3Ig
dGhlIHF1aWNrIHJlc3BvbnNlISBJIGhhdmUgYWxyZWFkeSByZXF1ZXN0ZWQgdGhlIENWRSBJ
RCwgDQo+IGFuZCBJIGFtIG9ubHkgd2FpdGluZyBvbiBhIHJlc3BvbnNlIGZyb20gdGhlIENO
QS4NCj4gSSB3aWxsIHNlbmQgYW4gdXBkYXRlIHRvIHRoZSBtYWlsaW5nIGxpc3Qgd2l0aCB0
aGUgSUQgYXNzaWduZWQgdG8gdGhlIA0KPiB2dWxuZXJhYmlsaXR5IGFzIHNvb24gYXMgcG9z
c2libGUhDQo+DQo+IFJlZ2FyZHMsDQo+DQpJIGFtIGF3YXJlIGl0IGhhcyBiZWVuIGEgd2hp
bGUgc2luY2UgSSBzZW50IHRoZSBhYm92ZSBtZXNzYWdlLiBJIGhhdmUgDQpiZWVuIHdhaXRp
bmcgZm9yIHRoZSBDVkUgSUQgYXNzaWdubWVudCwgYnV0IHRoZXJlIHdhcyBubyByZXNwb25z
ZSB0byBteSANCnJlcXVlc3Qgc28gZmFyLiBJIHdpbGwgdHJ5IHRvIG1ha2UgYSBuZXcgcmVx
dWVzdCBhbmQgaWYgYW4gSUQgaXMgDQphc3NpZ25lZCwgSSB3aWxsIHNoYXJlIGl0IHRocm91
Z2ggdGhpcyBlbWFpbCB0aHJlYWQuDQoNClJlZ2FyZHMsDQoNCi0tIA0KQ2FtaWxhIENhbWFy
Z28gZGUgTWF0b3MNClNlY3VyaXR5IEVuZ2luZWVyIEAgU1VTRSBTb2Z0d2FyZSBTb2x1dGlv
bnMNCkdQRzogQjlERiAwRjAzIDA2NDAgRTc4MCA2QjQ3IEU2MEUgQkYzNiBCREU5IEQwMzQg
MzBEMQ0KDQo=
--------------UOirIq3gYiRWL0S6A76tPodk
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
  </head>
  <body>
    <p>Hello Mesa developers.</p>
    <div class=3D"moz-cite-prefix">On 3/12/26 09:48, Camila Camargo de
      Matos wrote:<br>
    </div>
    <blockquote type=3D"cite"
      cite=3D"mid:[email protected]">
      <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DU=
TF-8">
      <div class=3D"moz-cite-prefix">On 3/7/26 12:46, Eric Engestrom
        wrote:<span style=3D"white-space: pre-wrap">
</span></div>
      <blockquote type=3D"cite" cite=3D"mid:[email protected]=
">
        <pre wrap=3D"" class=3D"moz-quote-pre">Hi Camila,

Thank you for offering!  The team who discovered and reported the issue i=
s not
yet able to go through the CVE process, so we would love to take you up o=
n
your offer to do it for us.

Cheers,
  Eric
</pre>
      </blockquote>
      <p>Thank you for the quick response! I have already requested the
        CVE ID, and I am only waiting on a response from the CNA.<br>
        I will send an update to the mailing list with the ID assigned
        to the vulnerability as soon as possible!</p>
      <p>Regards,</p>
    </blockquote>
    <p>I am aware it has been a while since I sent the above message. I
      have been waiting for the CVE ID assignment, but there was no
      response to my request so far. I will try to make a new request
      and if an ID is assigned, I will share it through this email
      thread.</p>
    <p>Regards,</p>
    <pre class=3D"moz-signature" cols=3D"72">--=20
Camila Camargo de Matos
Security Engineer @ SUSE Software Solutions
GPG: B9DF 0F03 0640 E780 6B47 E60E BF36 BDE9 D034 30D1</pre>
  </body>
</html>

--------------UOirIq3gYiRWL0S6A76tPodk--

--------------GTQV0rcOmLVuZ0ky1XQmXaje--

--------------IMCCgT96FYWA3t5W8mn0c0Sc
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKgfuC1XqvyVMOyRhP/dL5hYHRZgFAmnZETgACgkQP/dL5hYH
RZiSmRAAjevAV8t34YQvDv3K5c42EjD18GWZbmDJ6djJRyrVv3kzSAF9BuAaDOPi
1Pp3owHCVxkYSXc+XvSriYLx7zwgTLlF+X9xAvgcQHakhxyD3latckuV2dBCjNKP
8P/ZIygKxSOIcjPv3GEiydMpdFShLmgYTm6+ypezgL+BNpb+xx5gsZV9rJPIO6OF
nmes/VdzWI4sV6tyg1go3BfJVwgjrp7rCCGLiqm7Fg7viPx0dC6FxCS0+WR/QFWT
6jPu0L45IOBkWNTEtxPH1acgN4Hs5lcJBIMGj5kQcdkQggXLqgOTThuY581vYwo/
JHRjRXh9Pzz6fUggJuVFkR7B7PbNo8CESqZBj3PptuaQAs0uw0LkgoB1SuzpoTQl
T9nuHyPmwm1fRmfORdX/5CmizLQXo0pNsTLh6f4GbrUXIplQ0JVv3I292LERqZtg
ddZfe16hB5SpBybEK3cGnT7nj5lIoZN1vkDrDOk87ec6wugaZPsfbQPgsF7tAVXm
pWamHOtxgiFk53ypBxcwFRqu++sI36Kq/+bWLPe5JcuEEEe09k0/Yxd1r4bN1Ikn
cA76HypR9uLxjjQGglQC0mULcoJNORYtdh0OXR1xe+yqtCvy4OW3vALfbJryaptj
aWjmOdo+pBrQo72X9Q+CCcS9vb9RTFxsc7v9zlCVhJiZemitNzw=
=YfxH
-----END PGP SIGNATURE-----

--------------IMCCgT96FYWA3t5W8mn0c0Sc--