CVE-2026-53210
tee: shm: fix shm leak in register_shm_helper()
Description
In the Linux kernel, the following vulnerability has been resolved: tee: shm: fix shm leak in register_shm_helper() register_shm_helper() allocates shm before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function jumps to err_ctx_put and leaks shm. This can be triggered by TEE_IOC_SHM_REGISTER with struct tee_ioctl_shm_register_data where length is 0. Jump to err_free_shm instead.
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 2, 2026, 8:54 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Apply the patch to resolve the shared memory leak.
- Ensure register_shm_helper correctly handles zero-length shared memory.
- Update the Linux kernel to the corrected version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53210.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53210 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53210
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53210 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53210 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 02, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-401 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.8 up to (excluding) 6.12.94 Added Reference Type kernel.org: https://git.kernel.org/stable/c/26682f5efc276e3ad96d102019472bfbf03833b2 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4277759906b44d923a38c8f59f5576501b187b0d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c10c9c48b2903f41ed4c532043b0576e86228236 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/dbf779db927414f5b37c1f666013e9b48a88cfde Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '7bdee41575919773818e525ea19e54eb817770af', 'lessThan': '4277759906b44d923a38c8f59f5576501b187b0d', 'versionType': 'git'}, {'status': 'affected', 'version': '7bdee41575919773818e525ea19e54eb817770af', 'lessThan': 'c10c9c48b2903f41ed4c532043b0576e86228236', 'versionType': 'git'}, {'status': 'affected', 'version': '7bdee41575919773818e525ea19e54eb817770af', 'lessThan': 'dbf779db927414f5b37c1f666013e9b48a88cfde', 'versionType': 'git'}, {'status': 'affected', 'version': '7bdee41575919773818e525ea19e54eb817770af', 'lessThan': '26682f5efc276e3ad96d102019472bfbf03833b2', 'versionType': 'git'}], 'programFiles': ['drivers/tee/tee_shm.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.8'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.8', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/tee/tee_shm.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: tee: shm: fix shm leak in register_shm_helper() register_shm_helper() allocates shm before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function jumps to err_ctx_put and leaks shm. This can be triggered by TEE_IOC_SHM_REGISTER with struct tee_ioctl_shm_register_data where length is 0. Jump to err_free_shm instead. Added Reference https://git.kernel.org/stable/c/26682f5efc276e3ad96d102019472bfbf03833b2 Added Reference https://git.kernel.org/stable/c/4277759906b44d923a38c8f59f5576501b187b0d Added Reference https://git.kernel.org/stable/c/c10c9c48b2903f41ed4c532043b0576e86228236 Added Reference https://git.kernel.org/stable/c/dbf779db927414f5b37c1f666013e9b48a88cfde