CVE-2026-53210

About vulnerability

In the Linux kernel, the following vulnerability has been resolved: tee: shm: fix shm leak in register_shm_helper() register_shm_helper() allocates shm before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function jumps to err_ctx_put and leaks shm. This can be triggered by TEE_IOC_SHM_REGISTER with struct tee_ioctl_shm_register_data where length is 0. Jump to err_free_shm instead. A flaw was found in the Linux kernel’s Trusted Execution Environment (TEE) subsystem. A shared memory (shm) leak occurs in the register_shm_helper() function when TEE_IOC_SHM_REGISTER is called with a zero-length shared memory registration. This can be triggered by a local attacker, potentially leading to a denial of service due to memory exhaustion.

Live-patch status from KernelCare for each operating system.