Junglewise Threat Intelligence

CVE-2025-39865: Linux Kernel NULL pointer dereference in tee_shm_put

CVE-2025-39865 · Severity: medium · CVSS 5.5 · Published 2025-09-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Trusted Execution Environment (TEE) subsystem could allow a local user to crash the system. The issue occurs during specific power management operations, such as system shutdown or hibernation, when the kernel incorrectly handles memory references. This results in a system 'panic' or crash, leading to a denial of service.

Technical details

A NULL pointer dereference exists in the tee_shm_put function within the Linux kernel's TEE (Trusted Execution Environment) driver. The vulnerability is triggered when __optee_disable_shm_cache calls tee_shm_free with a NULL shared memory pointer returned by reg_pair_to_ptr. This occurs during device shutdown or hibernation sequences (e.g., via sysfs state_store). A local attacker with sufficient privileges to trigger power state changes or interact with TEE device drivers could cause a kernel panic (Oops). The fix introduces a NULL check for the shm pointer and its associated context in tee_shm_put.

Affected products

  • Linux Linux Kernel 4.14.261 to 4.15, 4.19.224 to 4.20, 5.4.170 to 5.5, 5.10.89 to 5.10.243, 5.15.12 to 5.15.192, 5.16.1 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.6

Timeline

  • 2025-07-23: other: Patch authored
  • 2025-09-09: patched: Patch committed to stable trees
  • 2025-09-19: disclosed: CVE published

References

Related threats