What is the CVSS score of EUVD-2026-39301?

EUVD-2026-39301 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-39301?

Yes, a patch is available for EUVD-2026-39301. Update the affected software to the latest version immediately.

Linux Kernel EUVD-2026-39301

| CVE-2026-53210 MEDIUM

Memory Leak (CWE-401)

2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-wfx4-v2wf-4gmp

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local ioctl access with low privileges sufficient to trigger leak; no confidentiality or integrity impact, only memory exhaustion availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 23:17 vuln.today

CVSS changed

Jul 02, 2026 - 21:07 NVD

5.5 (MEDIUM)

Patch available

Jun 25, 2026 - 10:32 EUVD

CVE Published

Jun 25, 2026 - 09:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 25, 2026 - 09:16 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

tee: shm: fix shm leak in register_shm_helper()

register_shm_helper() allocates shm before calling iov_iter_npages(). If iov_iter_npages() returns 0, the function jumps to err_ctx_put and leaks shm.

This can be triggered by TEE_IOC_SHM_REGISTER with struct tee_ioctl_shm_register_data where length is 0.

Jump to err_free_shm instead.

AnalysisAI

Memory leak in the Linux kernel TEE subsystem's register_shm_helper() function allows a local low-privileged user to exhaust kernel memory and degrade system availability. Triggering the leak requires calling the TEE_IOC_SHM_REGISTER ioctl with a length of zero, causing the function to allocate shared memory and then skip its deallocation when iov_iter_npages() returns 0. No public exploit has been identified at time of analysis, and EPSS sits at the 7th percentile, indicating very low real-world exploitation probability.

Technical ContextAI

The Linux kernel TEE (Trusted Execution Environment) subsystem provides a kernel driver interface for user-space applications to communicate with hardware-backed secure enclaves such as ARM TrustZone. The affected code path, register_shm_helper() in drivers/tee/tee_shm.c, allocates a shm object prior to calling iov_iter_npages() to determine the number of pages for the shared memory region. When a caller submits a tee_ioctl_shm_register_data structure with length=0 via the TEE_IOC_SHM_REGISTER ioctl, iov_iter_npages() legitimately returns 0, and the error path jumps to err_ctx_put rather than err_free_shm, orphaning the allocated shm object. This is a classic CWE-401 (Missing Release of Memory after Effective Lifetime) defect. CPE data confirms the affected product is cpe:2.3:o:linux:linux_kernel across multiple stable branches, with the introducing commit identified as 7bdee41575919773818e525ea19e54eb817770af.

RemediationAI

Upgrade to a patched Linux kernel version: 6.12.94 or later on the 6.12 stable branch, 6.18.36 or later on the 6.18 stable branch, 7.0.13 or later on the 7.0 stable branch, or the 7.1 release. Upstream fix commits are available at https://git.kernel.org/stable/c/26682f5efc276e3ad96d102019472bfbf03833b2, https://git.kernel.org/stable/c/4277759906b44d923a38c8f59f5576501b187b0d, https://git.kernel.org/stable/c/c10c9c48b2903f41ed4c532043b0576e86228236, and https://git.kernel.org/stable/c/dbf779db927414f5b37c1f666013e9b48a88cfde, covering the respective stable branches. As a compensating control on systems where patching is not immediately possible, restrict access to the TEE device nodes (/dev/tee* and /dev/teepriv*) to only trusted service accounts using udev rules or filesystem permissions; this prevents unprivileged users from invoking the vulnerable ioctl entirely. Note that restricting the device node may break legitimate TEE-dependent workloads such as OP-TEE clients or secure key storage applications.

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

CVE-2023-41484 HIGH POC

8.1

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-39301 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-39301

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-401 – Memory Leak

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code