CVE-2026-53210

Analyzed Analyzed - Analysis Complete

TEE SHM Memory Leak in Linux Kernel

Publication date: 2026-06-25

Last updated on: 2026-07-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tee: shm: fix shm leak in register_shm_helper() register_shm_helper() allocates shm before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function jumps to err_ctx_put and leaks shm. This can be triggered by TEE_IOC_SHM_REGISTER with struct tee_ioctl_shm_register_data where length is 0. Jump to err_free_shm instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-02

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53210

EUVD

EUVD-2026-39301

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.8 (inc) to 6.12.94 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's TEE (Trusted Execution Environment) subsystem, specifically in the shared memory (shm) handling code. The function register_shm_helper() allocates shared memory before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function incorrectly jumps to an error handling path (err_ctx_put) that causes the allocated shared memory to be leaked instead of properly freed. This issue can be triggered by the TEE_IOC_SHM_REGISTER ioctl call when the length parameter in struct tee_ioctl_shm_register_data is set to 0.

Impact Analysis

The vulnerability leads to a memory leak in the kernel's shared memory management within the TEE subsystem. Over time, repeated triggering of this flaw could cause increased memory consumption, potentially degrading system performance or leading to resource exhaustion. This could affect system stability or availability.

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the issue in register_shm_helper() has been fixed. Specifically, the fix involves correcting the error handling path to prevent shared memory leaks when TEE_IOC_SHM_REGISTER is called with a length of 0.

If updating the kernel immediately is not possible, avoid triggering the TEE_IOC_SHM_REGISTER ioctl with a length of 0 in struct tee_ioctl_shm_register_data to prevent the vulnerability from being exploited.

Hi! I’m here to help you understand CVE-2026-53210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70