Medium 5.5Published Jun 25, 2026

CVE-2026-53210tee: shm: fix shm leak in register_shm_helper()

Updated under an hour ago (Oct 27, 2026, 7:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tee: shm: fix shm leak in register_shm_helper() register_shm_helper() allocates shm before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function jumps to err_ctx_put and leaks shm. This can be triggered by TEE_IOC_SHM_REGISTER with struct tee_ioctl_shm_register_data where length is 0. Jump to err_free_shm instead.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 25, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7bdee41575919773818e525ea19e54eb817770af before 4277759906b44d923a38c8f59f5576501b187b0d; from 7bdee41575919773818e525ea19e54eb817770af before c10c9c48b2903f41ed4c532043b0576e86228236; from 7bdee41575919773818e525ea19e54eb817770af before dbf779db927414f5b37c1f666013e9b48a88cfde; from 7bdee41575919773818e525ea19e54eb817770af before 26682f5efc276e3ad96d102019472bfbf03833b2	CNA record
linux linux_kernel linux:linux_kernel	from 6.8 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; 7.1; 7.1; 7.1; 7.1; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/4277759906b44d923a38c8f59f5576501b187b0d	patch
https://git.kernel.org/stable/c/c10c9c48b2903f41ed4c532043b0576e86228236	patch
https://git.kernel.org/stable/c/dbf779db927414f5b37c1f666013e9b48a88cfde	patch
https://git.kernel.org/stable/c/26682f5efc276e3ad96d102019472bfbf03833b2	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.