CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper()
In the Linux kernel, the following vulnerability has been resolved:
tee: shm: fix shm leak in registershmhelper()
registershmhelper() allocates shm before calling ioviternpages(). If ioviternpages() returns 0, the function jumps to errctxput and leaks shm.
This can be triggered by TEEIOCSHMREGISTER with struct teeioctlshmregisterdata where length is 0.
Jump to errfreeshm instead.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can trigger this issue?
A local attacker or process with low privileges can trigger it by issuing TEE_IOC_SHM_REGISTER with a tee_ioctl_shm_register_data length of 0. No user interaction is required.
What is the impact of successful exploitation?
The affected error path leaks shared-memory allocations when iov_iter_npages() returns 0. The CVSS vector rates the availability impact as high, indicating repeated triggering may cause a denial of service through resource exhaustion.
How can I determine whether a system is exposed?
Exposure depends on whether the running Linux kernel contains the vulnerable register_shm_helper() error path and allows access to the TEE shared-memory registration ioctl. The provided trigger condition is a zero-length TEE_IOC_SHM_REGISTER request.
What should be done if the system cannot be patched immediately?
Restrict local access to untrusted users and processes that could issue TEE_IOC_SHM_REGISTER requests. Apply the available kernel patch when feasible.