CVE-2026-53210 PUBLISHED

tee: shm: fix shm leak in register_shm_helper()

Assigner: Linux
Reserved: 09.06.2026 Published: 25.06.2026 Updated: 25.06.2026

In the Linux kernel, the following vulnerability has been resolved:

tee: shm: fix shm leak in register_shm_helper()

register_shm_helper() allocates shm before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function jumps to err_ctx_put and leaks shm.

This can be triggered by TEE_IOC_SHM_REGISTER with struct tee_ioctl_shm_register_data where length is 0.

Jump to err_free_shm instead.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 7bdee41575919773818e525ea19e54eb817770af to 4277759906b44d923a38c8f59f5576501b187b0d (excl.)
  • affected from 7bdee41575919773818e525ea19e54eb817770af to c10c9c48b2903f41ed4c532043b0576e86228236 (excl.)
  • affected from 7bdee41575919773818e525ea19e54eb817770af to dbf779db927414f5b37c1f666013e9b48a88cfde (excl.)
  • affected from 7bdee41575919773818e525ea19e54eb817770af to 26682f5efc276e3ad96d102019472bfbf03833b2 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.8 is affected
  • unaffected from 0 to 6.8 (excl.)
  • unaffected from 6.12.94 to 6.12.* (incl.)
  • unaffected from 6.18.36 to 6.18.* (incl.)
  • unaffected from 7.0.13 to 7.0.* (incl.)
  • unaffected from 7.1 to * (incl.)

References