CVE-2026-99097
Received Received - Intake

TEE SHM Zero-Sized Allocation Rejection in Linux Kernel

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size and passes it to alloc_pages_exact() without checking it. For size == 0 nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page allocator then trips its order > MAX_PAGE_ORDER warning and fails the allocation; on a panic_on_warn kernel that ends the boot. This can be triggered by TEE_IOC_SHM_ALLOC with struct tee_ioctl_shm_alloc_data where size is 0. Reject a zero page count, as register_shm_helper() already does for the register path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-99097
EUVD
EUVD-2026-109903

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux cf4441503e20a0c0a36e0a98dcf57de3d3844c91
Linux Linux cf4441503e20a0c0a36e0a98dcf57de3d3844c91
Linux Linux cf4441503e20a0c0a36e0a98dcf57de3d3844c91
Linux Linux cf4441503e20a0c0a36e0a98dcf57de3d3844c91
Linux Linux 6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the TEE (Trusted Execution Environment) subsystem. When a zero-sized allocation is requested via TEE_IOC_SHM_ALLOC, the function tee_dyn_shm_alloc_helper() calculates a page count of zero but passes it to alloc_pages_exact() without validation. This triggers undefined behavior in get_order(0), leading to a kernel warning or panic if panic_on_warn is enabled, potentially causing system boot failure.

Detection Guidance

This vulnerability can be detected by checking for zero-sized allocations in the TEE subsystem. Monitor kernel logs for warnings related to alloc_pages_exact or order > MAX_PAGE_ORDER. Use commands like dmesg | grep -i 'order' or journalctl -k | grep -i 'order' to inspect kernel messages for allocation failures.

Impact Analysis

If exploited, this vulnerability could cause a system crash during boot if the kernel is configured with panic_on_warn. It may also lead to denial-of-service conditions by preventing normal operation of systems relying on TEE for secure operations.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patching is not immediately possible, disable the TEE subsystem if not required. Monitor vendor advisories for updates and restrict access to the TEE_IOC_SHM_ALLOC ioctl to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99097. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart