Re: Question regarding the WebGPU security fix in Mesa 26.0.1 / 25.3.6

Camila Camargo de Matos <[email protected]> Mon, 13 Apr 2026 09:54:55 -0300
Newsgroups	gmane.comp.video.mesa3d.devel
Message-ID	<[email protected]>
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------v1OzrjQsPvpKrfsn0Kx1t0Ae
Content-Type: multipart/mixed; boundary="------------qHCr9k0eUMsbGll308otgjTl";
 protected-headers="v1"
From: Camila Camargo de Matos <[email protected]>
To: Eric Engestrom <[email protected]>, [email protected]
Message-ID: <[email protected]>
Subject: Re: Question regarding the WebGPU security fix in Mesa 26.0.1 /
 25.3.6
References: <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
In-Reply-To: <[email protected]>

--------------qHCr9k0eUMsbGll308otgjTl
Content-Type: multipart/alternative;
 boundary="------------7In4hhxcv9p4YUuNoalSAC5X"

--------------7In4hhxcv9p4YUuNoalSAC5X
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

Q1ZFLTIwMjYtNDAzOTMgaGFzIGJlZW4gYXNzaWduZWQgdG8gdGhlIGlzc3VlIQ0KDQpPbiA0
LzEwLzI2IDEyOjAzLCBDYW1pbGEgQ2FtYXJnbyBkZSBNYXRvcyB3cm90ZToNCj4NCj4gSGVs
bG8gTWVzYSBkZXZlbG9wZXJzLg0KPg0KPiBPbiAzLzEyLzI2IDA5OjQ4LCBDYW1pbGEgQ2Ft
YXJnbyBkZSBNYXRvcyB3cm90ZToNCj4+IE9uIDMvNy8yNiAxMjo0NiwgRXJpYyBFbmdlc3Ry
b20gd3JvdGU6DQo+Pj4gSGkgQ2FtaWxhLA0KPj4+DQo+Pj4gVGhhbmsgeW91IGZvciBvZmZl
cmluZyEgIFRoZSB0ZWFtIHdobyBkaXNjb3ZlcmVkIGFuZCByZXBvcnRlZCB0aGUgaXNzdWUg
aXMgbm90DQo+Pj4geWV0IGFibGUgdG8gZ28gdGhyb3VnaCB0aGUgQ1ZFIHByb2Nlc3MsIHNv
IHdlIHdvdWxkIGxvdmUgdG8gdGFrZSB5b3UgdXAgb24NCj4+PiB5b3VyIG9mZmVyIHRvIGRv
IGl0IGZvciB1cy4NCj4+Pg0KPj4+IENoZWVycywNCj4+PiAgICBFcmljDQo+Pg0KPj4gVGhh
bmsgeW91IGZvciB0aGUgcXVpY2sgcmVzcG9uc2UhIEkgaGF2ZSBhbHJlYWR5IHJlcXVlc3Rl
ZCB0aGUgQ1ZFIA0KPj4gSUQsIGFuZCBJIGFtIG9ubHkgd2FpdGluZyBvbiBhIHJlc3BvbnNl
IGZyb20gdGhlIENOQS4NCj4+IEkgd2lsbCBzZW5kIGFuIHVwZGF0ZSB0byB0aGUgbWFpbGlu
ZyBsaXN0IHdpdGggdGhlIElEIGFzc2lnbmVkIHRvIHRoZSANCj4+IHZ1bG5lcmFiaWxpdHkg
YXMgc29vbiBhcyBwb3NzaWJsZSENCj4+DQo+PiBSZWdhcmRzLA0KPj4NCj4gSSBhbSBhd2Fy
ZSBpdCBoYXMgYmVlbiBhIHdoaWxlIHNpbmNlIEkgc2VudCB0aGUgYWJvdmUgbWVzc2FnZS4g
SSBoYXZlIA0KPiBiZWVuIHdhaXRpbmcgZm9yIHRoZSBDVkUgSUQgYXNzaWdubWVudCwgYnV0
IHRoZXJlIHdhcyBubyByZXNwb25zZSB0byANCj4gbXkgcmVxdWVzdCBzbyBmYXIuIEkgd2ls
bCB0cnkgdG8gbWFrZSBhIG5ldyByZXF1ZXN0IGFuZCBpZiBhbiBJRCBpcyANCj4gYXNzaWdu
ZWQsIEkgd2lsbCBzaGFyZSBpdCB0aHJvdWdoIHRoaXMgZW1haWwgdGhyZWFkLg0KPg0KPiBS
ZWdhcmRzLA0KPg0KPiAtLSANCj4gQ2FtaWxhIENhbWFyZ28gZGUgTWF0b3MNCj4gU2VjdXJp
dHkgRW5naW5lZXIgQCBTVVNFIFNvZnR3YXJlIFNvbHV0aW9ucw0KPiBHUEc6IEI5REYgMEYw
MyAwNjQwIEU3ODAgNkI0NyBFNjBFIEJGMzYgQkRFOSBEMDM0IDMwRDENClJlZ2FyZHMsDQoN
Ci0tIA0KQ2FtaWxhIENhbWFyZ28gZGUgTWF0b3MNClNlY3VyaXR5IEVuZ2luZWVyIEAgU1VT
RSBTb2Z0d2FyZSBTb2x1dGlvbnMNCkdQRzogQjlERiAwRjAzIDA2NDAgRTc4MCA2QjQ3IEU2
MEUgQkYzNiBCREU5IEQwMzQgMzBEMQ0KDQo=
--------------7In4hhxcv9p4YUuNoalSAC5X
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
  </head>
  <body>
    <p>CVE-2026-40393 has been assigned to the issue!</p>
    <div class=3D"moz-cite-prefix">On 4/10/26 12:03, Camila Camargo de
      Matos wrote:<br>
    </div>
    <blockquote type=3D"cite"
      cite=3D"mid:[email protected]">
      <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DU=
TF-8">
      <p>Hello Mesa developers.</p>
      <div class=3D"moz-cite-prefix">On 3/12/26 09:48, Camila Camargo de
        Matos wrote:<br>
      </div>
      <blockquote type=3D"cite"
        cite=3D"mid:[email protected]">
        <meta http-equiv=3D"Content-Type"
          content=3D"text/html; charset=3DUTF-8">
        <div class=3D"moz-cite-prefix">On 3/7/26 12:46, Eric Engestrom
          wrote:<span style=3D"white-space: pre-wrap">
</span></div>
        <blockquote type=3D"cite" cite=3D"mid:aaxHGVS-nKAOFC2G@engestrom.=
ch">
          <pre wrap=3D"" class=3D"moz-quote-pre">Hi Camila,

Thank you for offering!  The team who discovered and reported the issue i=
s not
yet able to go through the CVE process, so we would love to take you up o=
n
your offer to do it for us.

Cheers,
  Eric
</pre>
        </blockquote>
        <p>Thank you for the quick response! I have already requested
          the CVE ID, and I am only waiting on a response from the CNA.<b=
r>
          I will send an update to the mailing list with the ID assigned
          to the vulnerability as soon as possible!</p>
        <p>Regards,</p>
      </blockquote>
      <p>I am aware it has been a while since I sent the above message.
        I have been waiting for the CVE ID assignment, but there was no
        response to my request so far. I will try to make a new request
        and if an ID is assigned, I will share it through this email
        thread.</p>
      <p>Regards,</p>
      <pre class=3D"moz-signature" cols=3D"72">--=20
Camila Camargo de Matos
Security Engineer @ SUSE Software Solutions
GPG: B9DF 0F03 0640 E780 6B47 E60E BF36 BDE9 D034 30D1</pre>
    </blockquote>
    Regards,
    <pre class=3D"moz-signature" cols=3D"72">--=20
Camila Camargo de Matos
Security Engineer @ SUSE Software Solutions
GPG: B9DF 0F03 0640 E780 6B47 E60E BF36 BDE9 D034 30D1</pre>
  </body>
</html>

--------------7In4hhxcv9p4YUuNoalSAC5X--

--------------qHCr9k0eUMsbGll308otgjTl--

--------------v1OzrjQsPvpKrfsn0Kx1t0Ae
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEKgfuC1XqvyVMOyRhP/dL5hYHRZgFAmnc56AACgkQP/dL5hYH
RZg37A//UkirlPxWtik2T7hdc4OAU+zy7pXJ9gU6qqSmN+769Ez1n8wZXfTwU0rg
nB+4WoeIFqJGp4unLg9wf2SDg60lDdCSluXpUkRDsaag7OTHAuB8fy9k3Jmyc/IB
Vs3dr84wmd+3Zs0ZvIzzaKkQ2MS710l/HPjvFgUfPHD4k//tGOVIvVnFrqYa1LTE
1D5X4aQmbWeO5oJVeqBuWxDMv0Lx5AkqaBy62MLNCXsjAvkh8dmdi8C9BZO56Dxw
Sm+igATT8TNTA7nWuJfrctbYyidcFO7zZD8IBF3inrFNSoHv7DKoiYzMoDTUfmBQ
LJxooVVxNPPK+F7MfnrgXkpJbuYht3d/oJY0BhYkPQC/7GXxJ0kTpiusXarliYje
nORXHV3Fq17YcDXOOktkLvXQU54pkLDYuJLL/QUzhepo/RUgsmdY1ubmUq5fD+wr
qsbNPCHU2E0Wf1c+Cz+SBhqnTgTR8QR06rcx5UKDcBOx8dqC0xfvFyjULumjG3RI
YVXUmK3GZ04nP3+MR1uHdN1KST0N2fc9cDRx97cEA6RNVlKQymhnDFrZQr/ElPec
CJA92mgqFmYdisz6ckpoW8Mc/u2FTtL1KQiIo7s8ARk7OCHwYJk4iF1PI+lSJHpx
PRhOfrwqcHROCvLKnlH7fc7+8APQvRwtNxLT3qZSDrs3/+NWZDE=
=I2IE
-----END PGP SIGNATURE-----

--------------v1OzrjQsPvpKrfsn0Kx1t0Ae--