Skip to main content

Linux Kernel EUVDEUVD-2026-39224

| CVE-2026-53273 HIGH
Use After Free (CWE-416)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-q972-3fgv-wchc
Denial Of Service Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local, low-priv access to the TEE device (AV:L/PR:L); exploitation hinges on winning a client-vs-supplicant race so AC:H; kernel UAF yields high C/I/A within the unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:50 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tee: optee: prevent use-after-free when the client exits before the supplicant

Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request.

If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free.

Serialise access to the request with supp->mutex:

  • Hold supp->mutex in optee_supp_recv() and optee_supp_send() while

looking up and touching the request.

  • Let optee_supp_thrd_req() notice that the client has terminated and

signal optee_supp_send() accordingly.

With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race.

AnalysisAI

Local privilege escalation or kernel memory corruption in the Linux kernel's OP-TEE (Trusted Execution Environment) driver arises from a use-after-free in the supplicant request path on ARM TrustZone systems. After commit 70b0d6b0a199 made the client wait killable, a client task can exit and kfree() its request while its ID still lives in supp->idr, so a later supplicant lookup dereferences freed memory. CVSS 7.8 (local, low privilege) with EPSS at 0.17% (7th percentile); no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

The flaw lives in the OP-TEE backend of the Linux kernel TEE subsystem (drivers/tee/optee/supplicant.c), the interface that lets a normal-world userspace 'tee-supplicant' daemon service requests originating from secure-world Trusted Applications on ARM TrustZone hardware. Communication uses a request queue plus an IDR (supp->idr) mapping request IDs to in-flight request objects shared between the requesting client thread (optee_supp_thrd_req) and the supplicant servicing threads (optee_supp_recv/optee_supp_send). The root cause is the classic use-after-free class (CWE-416): a lifetime/ownership mismatch where one actor frees an object another still references. The regression was introduced by commit 70b0d6b0a199 ('tee: optee: Fix supplicant wait loop'), which changed the client wait to killable and thereby allowed the client to terminate and free the request mid-flight; the fix serializes access with supp->mutex held across lookup and use in recv/send and has the client signal termination to the send path.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel for your branch - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, or 6.18.36 (or later, e.g. 7.0.13/7.1) - which serializes request access under supp->mutex. Apply the per-branch fix commits from https://git.kernel.org/stable (for example 373152c94e57e9592b68c100e224fbd943cfd608) if you maintain your own kernel tree, and consult https://nvd.nist.gov/vuln/detail/CVE-2026-53273 and https://vuldb.com/vuln/373819. Where patching must wait, the practical compensating control is to restrict access to the TEE device node (/dev/tee* and /dev/teepriv*) via tighter file permissions and group membership so only the legitimate tee-supplicant and trusted services can open it, which limits the local attackers able to drive the race at the cost of breaking any unprivileged client that relies on OP-TEE; on systems that do not actually use a Trusted Execution Environment, disabling/unloading the optee driver (or not enabling CONFIG_OPTEE) removes the vulnerable path entirely with no functional loss.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39224 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy