CVE-2026-53273

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel OP-TEE

Publication date: 2026-06-25

Last updated on: 2026-07-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request. If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free. Serialise access to the request with supp->mutex: * Hold supp->mutex in optee_supp_recv() and optee_supp_send() while looking up and touching the request. * Let optee_supp_thrd_req() notice that the client has terminated and signal optee_supp_send() accordingly. With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-08

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53273

EUVD

EUVD-2026-39224

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.14
linux	linux_kernel	6.14
linux	linux_kernel	6.14
linux	linux_kernel	6.14
linux	linux_kernel	6.14
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.4.291 (inc) to 5.5 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.10.235 (inc) to 5.10.259 (exc)
linux	linux_kernel	From 5.15.179 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.1.130 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.12.17 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.13.5 (inc) to 6.14 (exc)
linux	linux_kernel	From 6.14.1 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.6.80 (inc) to 6.6.143 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's tee optee component. It is a use-after-free issue that occurs when a client exits before the supplicant finishes processing its request.

Specifically, after a commit changed the client to be killable during shutdown or supplicant crashes, the client task can terminate while the supplicant is still handling its request. If the client exits first, it removes and frees the request from its queue, but the request ID remains in the supplicant's IDR structure.

Later, when the supplicant looks up the request by ID, it dereferences memory that has already been freed, causing a use-after-free condition.

The fix involves serializing access to the request using a mutex to ensure the request cannot be freed while the supplicant still holds a reference to it, thus eliminating the race condition.

Impact Analysis

This use-after-free vulnerability can lead to undefined behavior in the Linux kernel, such as memory corruption, system crashes, or potential escalation of privileges.

An attacker or malfunctioning client could exploit this flaw to cause instability or potentially execute arbitrary code within the kernel context, compromising system security and reliability.

Mitigation Strategies

The vulnerability has been resolved by changes in the Linux kernel that prevent use-after-free conditions in the tee optee subsystem. Immediate mitigation involves updating your Linux kernel to a version that includes the fix described in commit 70b0d6b0a199.

This fix serializes access to the request with supp->mutex, ensuring that requests are not freed while still referenced by the supplicant, eliminating the race condition.

Hi! I’m here to help you understand CVE-2026-53273. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70