Executive brief
A memory leak vulnerability was identified in the Linux kernel's Trusted Execution Environment (TEE) subsystem. The TEE subsystem is responsible for managing secure communication between the main operating system and a secure area of the processor. An attacker could exploit this flaw to cause the system to slowly run out of memory, potentially leading to a system crash or degraded performance.
Technical details
A memory leak exists in the 'register_shm_helper' function within 'drivers/tee/tee_shm.c' of the Linux kernel. The function allocates shared memory (shm) but fails to release it if 'iov_iter_npages()' returns zero, which occurs when a user provides a 'TEE_IOC_SHM_REGISTER' ioctl call with a length of 0. This flaw allows a local attacker to trigger repeated allocations without deallocation, leading to kernel memory exhaustion. The issue has been resolved by updating the error handling path to jump to 'err_free_shm' instead of 'err_ctx_put'. Patches are available in various stable kernel branches including 6.12.94, 6.18.36, and 7.0.13.
Affected products
- Linux Linux 6.8 to 6.12.93, 6.18.35, 7.0.12
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory