CVE-2026-40393 part 1 - out-of-bounds memory access in WebGPU

Origin: https://gitlab.freedesktop.org/mesa/mesa/-/commit/978fd42b4b7d1e9c0435ffa7e1a4d339cba9b76e

From 978fd42b4b7d1e9c0435ffa7e1a4d339cba9b76e Mon Sep 17 00:00:00 2001
From: Ian Romanick <ian.d.romanick@intel.com>
Date: Fri, 23 Jan 2026 09:58:26 -0800
Subject: [PATCH] spirv: Use STACK_ARRAY instead of NIR_VLA

The number of fields comes from the shader, so it could be a value large
enough that using alloca would be problematic.

Fixes: 2a023f30a64 ("nir/spirv: Add basic support for types")
Reviewed-by: Caio Oliveira <caio.oliveira@intel.com>
Reviewed-by: Ryan Neph <ryanneph@google.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
(cherry picked from commit 3da828d2dd12e20ba2afc152db8d7236c7a48c13)

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/40092>

Gbp-Pq: Name CVE-2026-40393-part1.patch

backport macro STACK_ARRAY, needed for fix for CVE-226-40393

Origin: https://gitlab.freedesktop.org/mesa/mesa/-/blob/f43cff3728e58c377d1e03b13db62514217abfe1/src/util/stack_array.h
Forwarded: not-needed
Last-Update: 2026-05-25 <YYYY-MM-DD, last update of the meta-information, optional>

Last-Update: 2026-05-25 <YYYY-MM-DD, last update of the meta-information, optional>
Gbp-Pq: Name backport_STACK_ARRAY.patch

[PATCH] kopper: Revert "kopper: Explicitly choose zink"

This reverts commit 854bc2ee05f90e426f318352682144050e402d4b.

Forcing zink explicitly would get zink-on-lvp picked up over llvmpipe
for gbm dri support, which is not intended. Currently, zink_screen's
choose_pdev won't be able to reject it when the driver name is explicit.
So we have to revert the change first to mitigate regressions.

Reported-by: @n3rdopolis @0xnihilo
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/13009
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/13053
Fixes: 854bc2ee05f ("kopper: Explicitly choose zink")
Acked-by: Mike Blumenkrantz <michael.blumenkrantz@gmail.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/35039>
(cherry picked from commit e6481d3f42e0cd735fda38fb3029e6f8abf5a0e6)

Gbp-Pq: Name kopper-Revert-kopper-Explicitly-choose-zink.patch

[PATCH] Revert "hasvk/elk: stop turning load_push_constants into load_uniform"

This reverts commit b036d2ded2de32e81730ec8ce37c803bad112efa.

This seems to break gtk4 and other stuff.

Cc: mesa-stable
(taking ack from Lionel saying we should revert)

Acked-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/35407>
(cherry picked from commit 870b8717b25eceadac8dd653debe8346826227cb)

Gbp-Pq: Name Revert-hasvk-elk-stop-turning-load_push_constants-in.patch

[PATCH 1/3] etnaviv: isa: Add txf instruction

This instruction is used to implement texelfetch.

Blob generates such txf's for
dEQP-GLES3.functional.shaders.texture_functions.texelfetch.+

Signed-off-by: Christian Gmeiner <cgmeiner@igalia.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/34685>

Gbp-Pq: Name etnaviv-add-support-for-texelfetch.patch

disable use of ppc64el assembly code

Bug-Debian: https://bugs.debian.org/1092890
Last-Update: 2025-02-02

Gbp-Pq: Name disable_ppc64el_assembly.diff

src_glx_dri_common.h

Gbp-Pq: Name src_glx_dri_common.h.diff

path_max

Gbp-Pq: Name path_max.diff

mesa (25.0.7-2+deb13u1) trixie; urgency=high

  * Non-maintainer upload by the LTS Team.
  * Backport patch for CVE-2026-40393:
    - backport support function STACK_ARRAY, cherry-pick file from upstream.
    - backport commits fixing the issue

[dgit import unpatched mesa 25.0.7-2+deb13u1]

Import mesa_25.0.7-2+deb13u1.debian.tar.xz

[dgit import tarball mesa 25.0.7-2+deb13u1 mesa_25.0.7-2+deb13u1.debian.tar.xz]

Import mesa_25.0.7.orig.tar.xz

[dgit import orig mesa_25.0.7.orig.tar.xz]