In the Linux kernel, the following vulnerability has been resolved:

tee: shm: fix shm leak in register_shm_helper()

register_shm_helper() allocates shm before calling
iov_iter_npages(). If iov_iter_npages() returns 0, the function
jumps to err_ctx_put and leaks shm.

This can be triggered by TEE_IOC_SHM_REGISTER with
struct tee_ioctl_shm_register_data where length is 0.

Jump to err_free_shm instead.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
7bdee41575919773818e525ea19e54eb817770af affected < 4277759906b44d923a38c8f59f5576501b187b0d
7bdee41575919773818e525ea19e54eb817770af affected < c10c9c48b2903f41ed4c532043b0576e86228236
7bdee41575919773818e525ea19e54eb817770af affected < dbf779db927414f5b37c1f666013e9b48a88cfde
7bdee41575919773818e525ea19e54eb817770af affected < 26682f5efc276e3ad96d102019472bfbf03833b2
Linux Linux affected
Version Status Constraints
6.8 affected —
0 unaffected < 6.8
6.12.94 unaffected ≤ 6.12.*
6.18.36 unaffected ≤ 6.18.*
7.0.13 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/26682f5efc276e3ad96d102019472bfbf03833b2 cve-icon
https://git.kernel.org/stable/c/4277759906b44d923a38c8f59f5576501b187b0d cve-icon
https://git.kernel.org/stable/c/c10c9c48b2903f41ed4c532043b0576e86228236 cve-icon
https://git.kernel.org/stable/c/dbf779db927414f5b37c1f666013e9b48a88cfde cve-icon
History

Thu, 25 Jun 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401

Thu, 25 Jun 2026 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tee: shm: fix shm leak in register_shm_helper() register_shm_helper() allocates shm before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function jumps to err_ctx_put and leaks shm. This can be triggered by TEE_IOC_SHM_REGISTER with struct tee_ioctl_shm_register_data where length is 0. Jump to err_free_shm instead.
Title tee: shm: fix shm leak in register_shm_helper()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-25T08:39:15.569Z

Reserved: 2026-06-09T07:44:35.391Z

Link: CVE-2026-53210

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T11:30:06Z

Weaknesses