{"id":"CLSA-2026-1787314086","summary":"Fix CVE(s): CVE-2026-40393","details":"   * SECURITY UPDATE: out-of-bounds memory access from an unbounded stack\n     allocation in the SPIR-V front end (ELSCVE-171724)\n     - debian/patches/backport-STACK_ARRAY.patch: add the upstream\n       src/util/stack_array.h helper, which the fix requires.\n     - debian/patches/CVE-2026-40393.patch: replace NIR_VLA, a bare alloca,\n       with STACK_ARRAY at the two sites whose element count comes from the\n       shader, in src/compiler/spirv/spirv_to_nir.c and\n       src/compiler/nir/nir_inline_functions.c.\n     - CVE-2026-40393","modified":"2026-10-26T09:31:47.504143788Z","published":"2026-08-21T12:08:18Z","upstream":["CVE-2026-40393"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787314086.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40393"}],"affected":[{"package":{"name":"libd3dadapter9-mesa","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libd3dadapter9-mesa?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libd3dadapter9-mesa-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libd3dadapter9-mesa-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libegl-mesa0","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libegl-mesa0?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libegl1-mesa","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libegl1-mesa?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libegl1-mesa-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libegl1-mesa-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libgbm-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgbm-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libgbm1","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgbm1?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libgl1-mesa-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgl1-mesa-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libgl1-mesa-dri","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgl1-mesa-dri?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libgl1-mesa-glx","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgl1-mesa-glx?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libglapi-mesa","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libglapi-mesa?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libgles2-mesa","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgles2-mesa?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libgles2-mesa-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libgles2-mesa-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libglx-mesa0","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libglx-mesa0?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libosmesa6","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libosmesa6?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libosmesa6-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libosmesa6-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libwayland-egl1-mesa","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libwayland-egl1-mesa?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libxatracker-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libxatracker-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"libxatracker2","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libxatracker2?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"mesa-common-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/mesa-common-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"mesa-opencl-icd","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/mesa-opencl-icd?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"mesa-va-drivers","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/mesa-va-drivers?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"mesa-vdpau-drivers","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/mesa-vdpau-drivers?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}},{"package":{"name":"mesa-vulkan-drivers","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/mesa-vulkan-drivers?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.8-0ubuntu1~18.04.1+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787314086.json"}}],"schema_version":"1.9.0"}