Live › vulnerability › CVE-2026-99097
Go to dashboardA zero-size request to the TEE shared memory ioctl (TEE_IOC_SHM_ALLOC) makes the kernel's page allocator hit a warning and fail the allocation. On kernels set to panic on warnings, this halts the machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Systems running a Linux kernel with the TEE subsystem (OP-TEE or similar trusted execution drivers) that expose /dev/tee devices to users who can issue the TEE_IOC_SHM_ALLOC ioctl. The sources do not state the affected kernel versions or whether default configurations expose the device. Machines without TEE support or with the device restricted to trusted users are less exposed.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size and passes it to alloc_pages_exact() without checking it. For size == 0 nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page allocator then trips its order > MAX_PAGE_ORDER warning and fails the allocation; on a panic_on_warn kernel that ends the boot.
This can be triggered by TEE_IOC_SHM_ALLOC with struct tee_ioctl_shm_alloc_data where size is 0.
Reject a zero page count, as register_shm_helper() already does for the register path.
This page as .md · .json · in your agent: get_signal("CVE-2026-99097")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.