CVE-2026-53273
tee: optee: prevent use-after-free when the client exits before the supplicant
Description
In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request. If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free. Serialise access to the request with supp->mutex: * Hold supp->mutex in optee_supp_recv() and optee_supp_send() while looking up and touching the request. * Let optee_supp_thrd_req() notice that the client has terminated and signal optee_supp_send() accordingly. With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race.
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 8, 2026, 4 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Hold mutex in receive and send functions.
- Signal client termination to send function.
- Update the Linux kernel to the patched version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53273.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53273 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53273
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53273 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53273 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.291 up to (excluding) 5.5 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.235 up to (excluding) 5.10.259 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.179 up to (excluding) 5.15.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.130 up to (excluding) 6.1.176 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.12.17 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13.5 up to (excluding) 6.14 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.14.1 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.80 up to (excluding) 6.6.143 Added Reference Type kernel.org: https://git.kernel.org/stable/c/373152c94e57e9592b68c100e224fbd943cfd608 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/387a926ee166814611acecb960207fe2f3c4fd3e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/416259cb5bffecaaae5f76539deb535a8c1b2c34 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/724d0caffd4204b46f78efe22f18f8338031c6e1 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9a0dc9279d0907b198f205a693aedf696b08145d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ae847ab29ded2d7cece4d5970f0edefa4137bf2f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d366a01475f927402c96a3fe78bfc06b924fc87d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d5b57bb314d79e99bebb58a53588fa11dd4dbf69 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0180cf0373f84fff61b16f8c062553a13dd7cfca', 'lessThan': '416259cb5bffecaaae5f76539deb535a8c1b2c34', 'versionType': 'git'}, {'status': 'affected', 'version': 'c0a9a948159153be145f9471435695373904ee6d', 'lessThan': '724d0caffd4204b46f78efe22f18f8338031c6e1', 'versionType': 'git'}, {'status': 'affected', 'version': 'ec18520f5edc20a00c34a8c9fdd6507c355e880f', 'lessThan': 'ae847ab29ded2d7cece4d5970f0edefa4137bf2f', 'versionType': 'git'}, {'status': 'affected', 'version': 'd61cc1a435e6894bfb0dd3370c6f765d2d12825d', 'lessThan': '9a0dc9279d0907b198f205a693aedf696b08145d', 'versionType': 'git'}, {'status': 'affected', 'version': 'fd9d2d6124c293e40797a080adf8a9c237efd8b8', 'lessThan': 'd366a01475f927402c96a3fe78bfc06b924fc87d', 'versionType': 'git'}, {'status': 'affected', 'version': '70b0d6b0a199c5a3ee6c72f5e61681ed6f759612', 'lessThan': 'd5b57bb314d79e99bebb58a53588fa11dd4dbf69', 'versionType': 'git'}, {'status': 'affected', 'version': '70b0d6b0a199c5a3ee6c72f5e61681ed6f759612', 'lessThan': '373152c94e57e9592b68c100e224fbd943cfd608', 'versionType': 'git'}, {'status': 'affected', 'version': '70b0d6b0a199c5a3ee6c72f5e61681ed6f759612', 'lessThan': '387a926ee166814611acecb960207fe2f3c4fd3e', 'versionType': 'git'}, {'status': 'affected', 'version': '3eb4911364c764572e9db4ab900a57689a54e8ce', 'versionType': 'git'}, {'status': 'affected', 'version': '21234efe2a8474a6d2d01ea9573319de7858ce44', 'versionType': 'git'}, {'status': 'affected', 'version': '5.10.235', 'lessThan': '5.10.259', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.15.179', 'lessThan': '5.15.210', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.130', 'lessThan': '6.1.176', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.80', 'lessThan': '6.6.143', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.17', 'lessThan': '6.12.94', 'versionType': 'semver'}, {'status': 'affected', 'version': '5.4.291', 'lessThan': '5.5', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.13.5', 'lessThan': '6.14', 'versionType': 'semver'}], 'programFiles': ['drivers/tee/optee/supp.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/tee/optee/supp.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request. If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free. Serialise access to the request with supp->mutex: * Hold supp->mutex in optee_supp_recv() and optee_supp_send() while looking up and touching the request. * Let optee_supp_thrd_req() notice that the client has terminated and signal optee_supp_send() accordingly. With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race. Added Reference https://git.kernel.org/stable/c/373152c94e57e9592b68c100e224fbd943cfd608 Added Reference https://git.kernel.org/stable/c/387a926ee166814611acecb960207fe2f3c4fd3e Added Reference https://git.kernel.org/stable/c/416259cb5bffecaaae5f76539deb535a8c1b2c34 Added Reference https://git.kernel.org/stable/c/724d0caffd4204b46f78efe22f18f8338031c6e1 Added Reference https://git.kernel.org/stable/c/9a0dc9279d0907b198f205a693aedf696b08145d Added Reference https://git.kernel.org/stable/c/ae847ab29ded2d7cece4d5970f0edefa4137bf2f Added Reference https://git.kernel.org/stable/c/d366a01475f927402c96a3fe78bfc06b924fc87d Added Reference https://git.kernel.org/stable/c/d5b57bb314d79e99bebb58a53588fa11dd4dbf69