{"id":"CVE-2026-99097","kind":"vulnerability","aliases":["CVE-2026-99097"],"related":[],"title":"Linux kernel: zero-sized TEE shared memory allocation crashes the kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()\n\ntee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size\nand passes it to alloc_pages_exact() without checking it. For size == 0\nnr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is\ndocumented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page\nallocator then trips its order > MAX_PAGE_ORDER warning and fails the\nallocation; on a panic_on_warn kernel that ends the boot.\n\nThis can be triggered by TEE_IOC_SHM_ALLOC with struct\ntee_ioctl_shm_alloc_data where size is 0.\n\nReject a zero page count, as register_shm_helper() already does for the\nregister path.","summary":"A zero-size request to the TEE shared memory ioctl (TEE_IOC_SHM_ALLOC) makes the kernel's page allocator hit a warning and fail the allocation. On kernels set to panic on warnings, this halts the machine.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","self-hosted","tee"],"not_affected_if":["default-config","no-tee-driver"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:04:03+00:00","updated_at":"2026-10-26T16:04:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T16:04:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: zero-sized TEE shared memory allocation crashes the kernel","impact":"low","summary":"A zero-size request to the TEE shared memory ioctl (TEE_IOC_SHM_ALLOC) makes the kernel's page allocator hit a warning and fail the allocation. On kernels set to panic on warnings, this halts the machine.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","tee","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local user can crash the kernel via panic_on_warn","analyst_note":"Confirm affected kernel version range and the fixed commit from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-99097) and whether /dev/tee access is restricted by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-tee-driver","default-config"],"who_is_affected":"Systems running a Linux kernel with the TEE subsystem (OP-TEE or similar trusted execution drivers) that expose /dev/tee devices to users who can issue the TEE_IOC_SHM_ALLOC ioctl. The sources do not state the affected kernel versions or whether default configurations expose the device. Machines without TEE support or with the device restricted to trusted users are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000616,"input_tokens":3527,"output_tokens":526,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99097':15A,18A '0':115C,119C,124C,128C,185C 'alloc':9A,41B,47B,54B,82C,87C,92C,107C,121C,143C,155C,174C,180C 'alreadi':195C 'bit':136C 'boot':165C 'call':125C 'caller':100C 'caller-suppli':99C 'check':111C 'count':190C 'crash':10A 'cve':13A,16A 'data':181C 'deriv':94C 'document':131C 'dyn':85C,90C 'end':163C 'exact':109C,123C 'fail':52B,153C 'follow':71C 'get':126C 'halt':63B 'helper':88C,93C,194C 'hit':48B 'host':25B 'infrastructur':19B 'ioc':39B,172C 'ioctl':37B,178C 'kernel':2A,12A,22B,44B,56B,69C,161C 'linux':1A,21B,68C 'linux-kernel':20B 'long':138C 'machin':65B 'make':42B 'max':148C 'memori':8A,36B 'nr':95C,116C 'order':127C,147C,150C 'page':46B,96C,108C,117C,122C,139C,142C,149C,189C 'panic':59B,158C 'pass':104C 'path':200C 'per':137C 'regist':192C,199C 'reject':78C,186C 'request':31B 'resolv':75C 'return':135C 'self':24B 'self-host':23B 'set':57B 'share':7A,35B 'shift':140C 'shm':40B,77C,86C,91C,173C,179C,193C 'size':5A,30B,81C,102C,114C,183C 'struct':176C 'suppli':101C 'tee':6A,26B,34B,38B,76C,84C,89C,171C,177C 'trigger':169C 'trip':145C 'undefin':133C 'vulner':72C 'warn':50B,61B,151C,160C 'without':110C 'zero':4A,29B,80C,188C 'zero-s':3A,28B,79C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the TEE subsystem (OP-TEE or similar trusted execution drivers) that expose /dev/tee devices to users who can issue the TEE_IOC_SHM_ALLOC ioctl. The sources do not state the affected kernel versions or whether default configurations expose the device. Machines without TEE support or with the device restricted to trusted users are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99097","severity":null,"published_at":"2026-10-26T15:16:48+00:00","modified_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}