{"id":"CVE-2021-44733","title":"A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11","summary":"A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-362"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.12, < 4.14.261","linux_kernel >= 4.15, < 4.19.224","linux_kernel >= 4.20, < 5.4.170","linux_kernel >= 5.5, < 5.10.89","linux_kernel >= 5.11, < 5.15.12","enterprise_linux = 8.0","fedora = 35","debian_linux = 9.0","debian_linux = 10.0","debian_linux = 11.0","h410c_firmware","h300s_firmware","h500s_firmware","h700s_firmware","h300e_firmware","h500e_firmware","h700e_firmware","h410s_firmware"],"patched":["linux_kernel 5.15.12"],"published":"2021-12-22","updated":"2026-08-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-44733","references":[{"url":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dfd0743f1d9ea76931510ed150334d571fbab49d","label":"cve@mitre.org"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/tee/tee_shm.c","label":"cve@mitre.org"},{"url":"https://github.com/pjlantz/optee-qemu/blob/main/README.md","label":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html","label":"cve@mitre.org"},{"url":"https://lore.kernel.org/lkml/20211215092501.1861229-1-jens.wiklander%40linaro.org/","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20220114-0003/","label":"cve@mitre.org"},{"url":"https://www.debian.org/security/2022/dsa-5096","label":"cve@mitre.org"},{"url":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dfd0743f1d9ea76931510ed150334d571fbab49d","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/tee/tee_shm.c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/pjlantz/optee-qemu/blob/main/README.md","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lore.kernel.org/lkml/20211215092501.1861229-1-jens.wiklander%40linaro.org/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20220114-0003/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2022/dsa-5096","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.00702,"epssPercentile":0.5141,"ingestedAt":"2026-08-05T18:50:24.942Z","exploits":{"github":1,"githubRepos":["https://github.com/pjlantz/optee-qemu"],"checkedAt":"2026-09-21T15:24:33.809Z"},"exploitAvailable":true,"slug":"CVE-2021-44733","body":"## Overview\n\nA use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.\n\n## Affected\n\n- `linux_kernel >= 4.12, < 4.14.261`\n- `linux_kernel >= 4.15, < 4.19.224`\n- `linux_kernel >= 4.20, < 5.4.170`\n- `linux_kernel >= 5.5, < 5.10.89`\n- `linux_kernel >= 5.11, < 5.15.12`\n- `enterprise_linux = 8.0`\n- `fedora = 35`\n- `debian_linux = 9.0`\n- `debian_linux = 10.0`\n- `debian_linux = 11.0`\n- `h410c_firmware`\n- `h300s_firmware`\n- `h500s_firmware`\n- `h700s_firmware`\n- `h300e_firmware`\n- `h500e_firmware`\n- `h700e_firmware`\n- `h410s_firmware`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 5.15.12`","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":38.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4554,"id":"CVE-2021-44733","ts":1788887189813,"field":"exploit_available","old":"false","new":"true"},{"seq":3437,"id":"CVE-2021-44733","ts":1788886307050,"field":"exploit_available","old":"true","new":"false"},{"seq":2291,"id":"CVE-2021-44733","ts":1788882976761,"field":"exploit_available","old":"false","new":"true"},{"seq":1320,"id":"CVE-2021-44733","ts":1788882388728,"field":"exploit_available","old":"true","new":"false"},{"seq":434,"id":"CVE-2021-44733","ts":1788881824334,"field":"exploit_available","old":"false","new":"true"}]}