UBUNTU-CVE-2026-99097: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in teedynshmallochelper() teedynshmallochelper() derives nrpages from a caller-supplied size and passes it to allocpagesexact() without checking it. For size == 0 nrpages is 0, and allocpagesexact(0) calls getorder(0), which is documented as undefined and returns BITSPERLONG - PAGESHIFT. The page allocator then trips its order > MAXPAGEORDER warning and fails the allocation; on a paniconwarn kernel that ends the boot. This can be triggered by TEEIOCSHMALLOC with struct teeioctlshmallocdata where size is 0. Reject a zero page count, as registershmhelper() already does for the register path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Modify tee_dyn_shm_alloc_helper() to reject a zero page count derived from a caller-supplied size before calling alloc_pages_exact(), preventing zero-sized TEE_IOC_SHM_ALLOC allocations.
Event History
Frequently Asked Questions
What access is needed to trigger this issue?
An attacker needs the ability to issue the TEE_IOC_SHM_ALLOC ioctl with a shared-memory allocation size of zero. The provided data does not specify which users or processes can access the relevant TEE device.
When can this become a denial of service?
A zero-sized allocation causes a page-allocation warning because it reaches alloc_pages_exact() with zero pages. On systems configured with panic_on_warn, that warning ends the boot.
What is the immediate mitigation if an update cannot be applied?
Prevent untrusted processes from issuing TEE_IOC_SHM_ALLOC requests with a zero size. Avoid enabling panic_on_warn where this ioctl can be reached, since the warning is what causes the boot-ending failure.
How can I identify an attempted trigger?
Look for TEE_IOC_SHM_ALLOC calls using struct tee_ioctl_shm_alloc_data with size set to zero. Affected systems may also log a page-allocator warning about an order greater than MAX_PAGE_ORDER.