CVE-2026-99097
Description
In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size and passes it to alloc_pages_exact() without checking it. For size == 0 nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page allocator then trips its order > MAX_PAGE_ORDER warning and fails the allocation; on a panic_on_warn kernel that ends the boot. This can be triggered by TEE_IOC_SHM_ALLOC with struct tee_ioctl_shm_alloc_data where size is 0. Reject a zero page count, as register_shm_helper() already does for the register path.
How to fix
- Linux Linuxe5dc7af9c3a5373ee7a84959126e7dfa9e4ad50d, 65cb86860a80ffc6af897d53f5bd4b1733bca0ec, c2a97703359e25ec7ef8b2b0ef32fb3982add90a, b7f925fd5226deb953c8dcdc9677d3fcc2717c00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | cf4441503e20a0c0a36e0a98dcf57de3d3844c91 ≤ v < e5dc7af9c3a5373ee7a84959126e7dfa9e4ad50d, cf4441503e20a0c0a36e0a98dcf57de3d3844c91 ≤ v < 65cb86860a80ffc6af897d53f5bd4b1733bca0ec, cf4441503e20a0c0a36e0a98dcf57de3d3844c91 ≤ v < c2a97703359e25ec7ef8b2b0ef32fb3982add90a, cf4441503e20a0c0a36e0a98dcf57de3d3844c91 ≤ v < b7f925fd5226deb953c8dcdc9677d3fcc2717c00, 6.10 | e5dc7af9c3a5373ee7a84959126e7dfa9e4ad50d, 65cb86860a80ffc6af897d53f5bd4b1733bca0ec, c2a97703359e25ec7ef8b2b0ef32fb3982add90a, b7f925fd5226deb953c8dcdc9677d3fcc2717c00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.