CVE-2026-99097: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

Published Oct 26, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

tee: shm: reject zero-sized allocations in teedynshmallochelper()

teedynshmallochelper() derives nrpages from a caller-supplied size and passes it to allocpagesexact() without checking it. For size == 0 nrpages is 0, and allocpagesexact(0) calls getorder(0), which is documented as undefined and returns BITSPERLONG - PAGESHIFT. The page allocator then trips its order > MAXPAGEORDER warning and fails the allocation; on a paniconwarn kernel that ends the boot.

This can be triggered by TEEIOCSHMALLOC with struct teeioctlshmallocdata where size is 0.

Reject a zero page count, as registershmhelper() already does for the register path.

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Reject zero-sized allocations in tee_dyn_shm_alloc_helper() before deriving nr_pages or calling alloc_pages_exact().

Event History

Oct 26, 2026

CVE Published

via MITRE·02:52 PM

Data Sourced

via MITRE·02:52 PM

Description

Frequently Asked Questions

What condition makes this issue capable of ending the boot process?

A zero-sized shared-memory allocation causes the page allocator to emit an order-greater-than-MAX_PAGE_ORDER warning and fail the allocation. On kernels configured with panic_on_warn, that warning ends the boot.

What temporary mitigation is available if the fix cannot be deployed immediately?

Prevent TEE shared-memory allocation requests with a size of zero from reaching the affected allocation path. The vulnerable request is TEE_IOC_SHM_ALLOC with the size field in struct tee_ioctl_shm_alloc_data set to 0.

Is the shared-memory registration path subject to the same missing check?

The data indicates that register_shm_helper() already rejects a zero page count. The missing validation was in the dynamic shared-memory allocation helper used by the allocation path.

CVE-2026-99097: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

Affected Software

Remediation

Event History

Frequently Asked Questions

What condition makes this issue capable of ending the boot process?

What temporary mitigation is available if the fix cannot be deployed immediately?

Is the shared-memory registration path subject to the same missing check?

Company

Resources

Contact

Frequently Asked Questions

What condition makes this issue capable of ending the boot process?

What temporary mitigation is available if the fix cannot be deployed immediately?

Is the shared-memory registration path subject to the same missing check?