Skip to content
OpenAdvisories
High ALAS2-2026-3330 1 CVE

Important: mesa security update (Amazon Linux 2)

Published Jun 8, 2026 · Updated Jun 8, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-40393: In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.

Fixed packages 19

ReleasePackageFixed in
Amazon Linux · 2 mesa-debuginfo 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-dri-drivers 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-filesystem 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-khr-devel 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libEGL 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libEGL-devel 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libgbm 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libgbm-devel 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libGL 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libGL-devel 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libglapi 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libGLES 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libGLES-devel 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libOSMesa 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libOSMesa-devel 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libxatracker 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-libxatracker-devel 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-vdpau-drivers 0:18.3.4-5.amzn2.0.2
Amazon Linux · 2 mesa-vulkan-drivers 0:18.3.4-5.amzn2.0.2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-40393.html