CVE-2026-53273
Received Received - Intake
Use-After-Free in Linux Kernel OP-TEE

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request. If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free. Serialise access to the request with supp->mutex: * Hold supp->mutex in optee_supp_recv() and optee_supp_send() while looking up and touching the request. * Let optee_supp_thrd_req() notice that the client has terminated and signal optee_supp_send() accordingly. With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53273
EUVD
EUVD-2026-39224
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tee optee *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's tee optee component. It is a use-after-free issue that occurs when a client exits before the supplicant finishes processing its request.

Specifically, after a commit changed the client to be killable during shutdown or supplicant crashes, the client task can terminate while the supplicant is still handling its request. If the client exits first, it removes and frees the request from its queue, but the request ID remains in the supplicant's IDR structure.

Later, when the supplicant looks up the request by ID, it dereferences memory that has already been freed, causing a use-after-free condition.

The fix involves serializing access to the request using a mutex to ensure the request cannot be freed while the supplicant still holds a reference to it, thus eliminating the race condition.

Impact Analysis

This use-after-free vulnerability can lead to undefined behavior in the Linux kernel, such as memory corruption, system crashes, or potential escalation of privileges.

An attacker or malfunctioning client could exploit this flaw to cause instability or potentially execute arbitrary code within the kernel context, compromising system security and reliability.

Mitigation Strategies

The vulnerability has been resolved by changes in the Linux kernel that prevent use-after-free conditions in the tee optee subsystem. Immediate mitigation involves updating your Linux kernel to a version that includes the fix described in commit 70b0d6b0a199.

This fix serializes access to the request with supp->mutex, ensuring that requests are not freed while still referenced by the supplicant, eliminating the race condition.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart