CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper()

Q: Who can trigger this issue?

A local attacker or process with low privileges can trigger it by issuing TEE_IOC_SHM_REGISTER with a tee_ioctl_shm_register_data length of 0. No user interaction is required.

Q: What is the impact of successful exploitation?

The affected error path leaks shared-memory allocations when iov_iter_npages() returns 0. The CVSS vector rates the availability impact as high, indicating repeated triggering may cause a denial of service through resource exhaustion.

Q: How can I determine whether a system is exposed?

Exposure depends on whether the running Linux kernel contains the vulnerable register_shm_helper() error path and allows access to the TEE shared-memory registration ioctl. The provided trigger condition is a zero-length TEE_IOC_SHM_REGISTER request.

Q: What should be done if the system cannot be patched immediately?

Restrict local access to untrusted users and processes that could issue TEE_IOC_SHM_REGISTER requests. Apply the available kernel patch when feasible.

Published Jun 25, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

tee: shm: fix shm leak in registershmhelper()

registershmhelper() allocates shm before calling ioviternpages(). If ioviternpages() returns 0, the function jumps to errctxput and leaks shm.

This can be triggered by TEEIOCSHMREGISTER with struct teeioctlshmregisterdata where length is 0.

Jump to errfreeshm instead.

Affected Software

10 affected components

Linux Linux kernel

Linux Linux kernel>=6.8<6.12.94

Linux Linux kernel>=6.13<6.18.36

Linux Linux kernel>=6.19<7.0.13

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Linux Linux kernel=7.1-rc3

Linux Linux kernel=7.1-rc4

Linux Linux kernel=7.1-rc5

Linux Linux kernel=7.1-rc6

Remediation

Event History

Jun 25, 2026

CVE Published

via MITRE·08:39 AM

Data Sourced

via MITRE·08:39 AM

Description

Data Sourced

via NVD·09:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can trigger this issue?

A local attacker or process with low privileges can trigger it by issuing TEE_IOC_SHM_REGISTER with a tee_ioctl_shm_register_data length of 0. No user interaction is required.

What is the impact of successful exploitation?

The affected error path leaks shared-memory allocations when iov_iter_npages() returns 0. The CVSS vector rates the availability impact as high, indicating repeated triggering may cause a denial of service through resource exhaustion.

How can I determine whether a system is exposed?

Exposure depends on whether the running Linux kernel contains the vulnerable register_shm_helper() error path and allows access to the TEE shared-memory registration ioctl. The provided trigger condition is a zero-length TEE_IOC_SHM_REGISTER request.

What should be done if the system cannot be patched immediately?

Restrict local access to untrusted users and processes that could issue TEE_IOC_SHM_REGISTER requests. Apply the available kernel patch when feasible.

CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper()

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

Who can trigger this issue?

What is the impact of successful exploitation?

How can I determine whether a system is exposed?

What should be done if the system cannot be patched immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger this issue?

What is the impact of successful exploitation?

How can I determine whether a system is exposed?

What should be done if the system cannot be patched immediately?