CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant
In the Linux kernel, the following vulnerability has been resolved:
tee: optee: prevent use-after-free when the client exits before the supplicant
Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request.
If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free.
Serialise access to the request with supp->mutex:
Hold supp->mutex in opteesupprecv() and opteesuppsend() while looking up and touching the request. Let opteesuppthrdreq() notice that the client has terminated and signal opteesuppsend() accordingly.
With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tee: opteeto a version that resolves this vulnerability.Patch 70b0d6b0a199 - Configuration
Modify the OP-TEE supplicant path so optee_supp_recv() and optee_supp_send() hold supp->mutex to serialize access to request objects and prevent use-after-free when the client exits first.
OP-TEE Linux kernel supplicant code supp->mutex usage in optee_supp_recv() and optee_supp_send() = Hold supp->mutex while executing optee_supp_recv() and optee_supp_send() - Configuration
Update optee_supp_thrd_req() so it detects client termination, removes the request from the client's queue expectations safely, and coordinates with the supplicant thread to eliminate the race.
OP-TEE Linux kernel supplicant code Client-termination handling in optee_supp_thrd_req() = Let optee_supp_thrd_req() notice that the client has terminated - Configuration
Change the client wait in the OP-TEE supplicant flow to be killable so it can be interrupted during shutdown, avoiding request lifetime/race issues after a client crash.
OP-TEE Linux kernel supplicant code Request wait behavior in client wait (killable) = Make client wait killable so it can be interrupted during shutdown
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53273?
CVE-2026-53273 has a risk score of 44, indicating a moderate severity level.
How do I fix CVE-2026-53273?
To fix CVE-2026-53273, you need to update your Linux kernel to the patched version that addresses the use-after-free vulnerability.
Which systems are affected by CVE-2026-53273?
CVE-2026-53273 affects the Linux kernel specifically in the tee/optee subsystem.
What type of vulnerability is CVE-2026-53273?
CVE-2026-53273 is categorized as a use-after-free vulnerability in the Linux kernel.
When was CVE-2026-53273 published?
CVE-2026-53273 was published on June 25, 2026.