All vulnerabilities
CVE-2026-99097

Linux: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in65cb86860a80ffc6af897d53f5bd4b1733bca0ecFixed versionCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 65cb86860a80ffc6af897d53f5bd4b1733bca0ecLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size and passes it to alloc_pages_exact() without checking it. For size == 0 nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page allocator then trips its order > MAX_PAGE_ORDER warning and fails the allocation; on a panic_on_warn kernel that ends the boot.

This can be triggered by TEE_IOC_SHM_ALLOC with struct tee_ioctl_shm_alloc_data where size is 0.

Reject a zero page count, as register_shm_helper() already does for the register path.

Text from CVE List

Affected versions 10

  • Linuxaffected: cf4441503e20a0c0a36e0a98dcf57de3d3844c91 before e5dc7af9c3a5373ee7a84959126e7dfa9e4ad50dCVE List
  • Linuxaffected: cf4441503e20a0c0a36e0a98dcf57de3d3844c91 before 65cb86860a80ffc6af897d53f5bd4b1733bca0ecCVE List
  • Linuxaffected: cf4441503e20a0c0a36e0a98dcf57de3d3844c91 before c2a97703359e25ec7ef8b2b0ef32fb3982add90aCVE List
  • Linuxaffected: cf4441503e20a0c0a36e0a98dcf57de3d3844c91 before b7f925fd5226deb953c8dcdc9677d3fcc2717c00CVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4