Mesa has released version 26.0.1, which includes a security fix for an out-of-bounds memory access in WebGPU. This bug caused browser crashes after recent graphics driver updates and was also responsible for hangs when launching WebGL-based games or video-editing tools that rely on WebGPU. The new release consolidates the patch with some minor tweaks, including better handling of descriptor buffers and clean-up of stale TCS outputs. Users can download the tarball from the Mesa archive and follow their distro's package upgrade routine to get the update.

Mesa 26.0.1: Patch the WebGPU Out‑of‑Bounds Bug (and a Few Minor Tweaks)

The newest Mesa drop, version 26.0.1, ships with a security fix that stops an out‑of‑bounds memory access in WebGPU. Anyone who’s seen their browser crash after a recent graphics driver update will understand why this patch is worth pulling down right away.

What Makes the Fix Essential

A handful of users reported hangs when launching WebGL‑based games or video‑editing tools that rely on WebGPU. The bug allowed code paths to read past the end of a buffer, potentially exposing data from other processes. Updating to 26.0.1 closes that window and restores stability for all web browsers that use the Mesa stack.

Other Highlights

• Bug‑fix release 25.3.6 already carried this patch; the new version simply consolidates it with a few housekeeping changes (e.g., better handling of descriptor buffers in Anv, clean‑up of stale TCS outputs in ir3).
• The commit logs show a handful of “drop buggy SLM optimization” and “fix compute pipeline cache” tweaks that mainly tidy up driver behaviour on Intel GPUs.
• No new features or bloated libraries were added—just a tighter codebase.

How to Get It

Download the tarball from the Mesa archive, verify its SHA256 hash (bb5104f9…b385dcc), and follow your distro’s package upgrade routine. If you’re on Ubuntu 23.10 or later, the repository update will push 26.0.1 automatically; otherwise grab the source, run meson build && ninja -C build install, and enjoy a safer WebGPU experience.

1. Grab the tarball –

   wget https://mesa.freedesktop.org/archive/mesa-26.0.1.tar.xz
   sha256sum mesa-26.0.1.tar.xz

   Verifying the sha256 checksum (bb5104f9f9a46c9b5175c24e601e0ef1ab44ce2d0fdbe81548b59adc8b385dcc) prevents a corrupted download from wrecking your build.

2. Extract and create a clean build directory –

   tar xf mesa-26.0.1.tar.xz
   mkdir mesa-build
   cd mesa-build

   Building in a separate folder keeps the source tree pristine, which helps when you need to switch back.

3. Configure with meson – For most users the default options are fine, but it’s worth explicitly disabling drivers you don’t use to speed up compilation:

   >meson setup .. \
     -Dgallium-drivers=radeonsi,swrast,virgl \
     -Dvulkan-drivers=radv,anv \
     -Dllvm=enabled \
     -Dshared-llvm=disabled

   Disabling unused drivers reduces build time and memory pressure on modest laptops.

4. Compile –

   >ninja -C .

   The -j$(nproc) flag is implied; if you’re on a 4‑core laptop, the compile will finish in roughly an hour.

5. Run a quick sanity check – Launch something lightweight that uses OpenGL (e.g., glxgears) and then a Vulkan demo (vkcube). Watch for immediate crashes or “device lost” messages; those indicate a regression that should be filed on the Mesa issue tracker.

Keep an Eye on March 11th

The next bug‑fix release is slated for March 11th, so expect another wave of minor fixes. If anything goes wrong after you upgrade—say the GPU stops drawing a particular texture—file it through the Mesa issue tracker and include the kernel log snippet that shows the offending memory access.