CVE-2026-53273High· 7.8▾ Twilight

tee: optee: prevent use-after-free when the client exits before the supplicant

In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as kil…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 25, 2026

Updated

Oct 16, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.12% · p2

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 113 days

Jun 25, 2026Published
Disclosed via CVEORG
Oct 16, 2026Record revised
Last analysed / modified upstream
Oct 16, 2026EPSS first tracked
0.1%

Linux #cve.org

Affected

Linux >= 0180cf0373f84fff61b16f8c062553a13dd7cfca < 416259cb5bffecaaae5f76539deb535a8c1b2c34
Linux >= c0a9a948159153be145f9471435695373904ee6d < 724d0caffd4204b46f78efe22f18f8338031c6e1
Linux >= ec18520f5edc20a00c34a8c9fdd6507c355e880f < ae847ab29ded2d7cece4d5970f0edefa4137bf2f
Linux >= d61cc1a435e6894bfb0dd3370c6f765d2d12825d < 9a0dc9279d0907b198f205a693aedf696b08145d
Linux >= fd9d2d6124c293e40797a080adf8a9c237efd8b8 < d366a01475f927402c96a3fe78bfc06b924fc87d
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < d5b57bb314d79e99bebb58a53588fa11dd4dbf69
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 373152c94e57e9592b68c100e224fbd943cfd608
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 387a926ee166814611acecb960207fe2f3c4fd3e
Linux 3eb4911364c764572e9db4ab900a57689a54e8ce
Linux 21234efe2a8474a6d2d01ea9573319de7858ce44
Linux >= 5.10.235 < 5.10.259
Linux >= 5.15.179 < 5.15.210
Linux >= 6.1.130 < 6.1.176
Linux >= 6.6.80 < 6.6.143
Linux >= 6.12.17 < 6.12.94
Linux >= 5.4.291 < 5.5
Linux >= 6.13.5 < 6.14
Linux 6.14

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

tee: optee: prevent use-after-free when the client exits before the supplicant

Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request.

If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free.

Serialise access to the request with supp->mutex:

Hold supp->mutex in optee_supp_recv() and optee_supp_send() while looking up and touching the request.
Let optee_supp_thrd_req() notice that the client has terminated and signal optee_supp_send() accordingly.

With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race.

Affected

Linux >= 0180cf0373f84fff61b16f8c062553a13dd7cfca < 416259cb5bffecaaae5f76539deb535a8c1b2c34
Linux >= c0a9a948159153be145f9471435695373904ee6d < 724d0caffd4204b46f78efe22f18f8338031c6e1
Linux >= ec18520f5edc20a00c34a8c9fdd6507c355e880f < ae847ab29ded2d7cece4d5970f0edefa4137bf2f
Linux >= d61cc1a435e6894bfb0dd3370c6f765d2d12825d < 9a0dc9279d0907b198f205a693aedf696b08145d
Linux >= fd9d2d6124c293e40797a080adf8a9c237efd8b8 < d366a01475f927402c96a3fe78bfc06b924fc87d
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < d5b57bb314d79e99bebb58a53588fa11dd4dbf69
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 373152c94e57e9592b68c100e224fbd943cfd608
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 387a926ee166814611acecb960207fe2f3c4fd3e
Linux 3eb4911364c764572e9db4ab900a57689a54e8ce
Linux 21234efe2a8474a6d2d01ea9573319de7858ce44
Linux >= 5.10.235 < 5.10.259
Linux >= 5.15.179 < 5.15.210
Linux >= 6.1.130 < 6.1.176
Linux >= 6.6.80 < 6.6.143
Linux >= 6.12.17 < 6.12.94
Linux >= 5.4.291 < 5.5
Linux >= 6.13.5 < 6.14
Linux 6.14

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

← Back to feed

CVE-2026-53273High· 7.8▾ Twilight

tee: optee: prevent use-after-free when the client exits before the supplicant

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 25, 2026

Updated

Oct 16, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.12% · p2

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 113 days

Jun 25, 2026Published
Disclosed via CVEORG
Oct 16, 2026Record revised
Last analysed / modified upstream
Oct 16, 2026EPSS first tracked
0.1%

Linux #cve.org

Affected

Linux >= 0180cf0373f84fff61b16f8c062553a13dd7cfca < 416259cb5bffecaaae5f76539deb535a8c1b2c34
Linux >= c0a9a948159153be145f9471435695373904ee6d < 724d0caffd4204b46f78efe22f18f8338031c6e1
Linux >= ec18520f5edc20a00c34a8c9fdd6507c355e880f < ae847ab29ded2d7cece4d5970f0edefa4137bf2f
Linux >= d61cc1a435e6894bfb0dd3370c6f765d2d12825d < 9a0dc9279d0907b198f205a693aedf696b08145d
Linux >= fd9d2d6124c293e40797a080adf8a9c237efd8b8 < d366a01475f927402c96a3fe78bfc06b924fc87d
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < d5b57bb314d79e99bebb58a53588fa11dd4dbf69
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 373152c94e57e9592b68c100e224fbd943cfd608
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 387a926ee166814611acecb960207fe2f3c4fd3e
Linux 3eb4911364c764572e9db4ab900a57689a54e8ce
Linux 21234efe2a8474a6d2d01ea9573319de7858ce44
Linux >= 5.10.235 < 5.10.259
Linux >= 5.15.179 < 5.15.210
Linux >= 6.1.130 < 6.1.176
Linux >= 6.6.80 < 6.6.143
Linux >= 6.12.17 < 6.12.94
Linux >= 5.4.291 < 5.5
Linux >= 6.13.5 < 6.14
Linux 6.14

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

tee: optee: prevent use-after-free when the client exits before the supplicant

Serialise access to the request with supp->mutex:

Hold supp->mutex in optee_supp_recv() and optee_supp_send() while looking up and touching the request.
Let optee_supp_thrd_req() notice that the client has terminated and signal optee_supp_send() accordingly.

With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race.

Affected

Linux >= 0180cf0373f84fff61b16f8c062553a13dd7cfca < 416259cb5bffecaaae5f76539deb535a8c1b2c34
Linux >= c0a9a948159153be145f9471435695373904ee6d < 724d0caffd4204b46f78efe22f18f8338031c6e1
Linux >= ec18520f5edc20a00c34a8c9fdd6507c355e880f < ae847ab29ded2d7cece4d5970f0edefa4137bf2f
Linux >= d61cc1a435e6894bfb0dd3370c6f765d2d12825d < 9a0dc9279d0907b198f205a693aedf696b08145d
Linux >= fd9d2d6124c293e40797a080adf8a9c237efd8b8 < d366a01475f927402c96a3fe78bfc06b924fc87d
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < d5b57bb314d79e99bebb58a53588fa11dd4dbf69
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 373152c94e57e9592b68c100e224fbd943cfd608
Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 387a926ee166814611acecb960207fe2f3c4fd3e
Linux 3eb4911364c764572e9db4ab900a57689a54e8ce
Linux 21234efe2a8474a6d2d01ea9573319de7858ce44
Linux >= 5.10.235 < 5.10.259
Linux >= 5.15.179 < 5.15.210
Linux >= 6.1.130 < 6.1.176
Linux >= 6.6.80 < 6.6.143
Linux >= 6.12.17 < 6.12.94
Linux >= 5.4.291 < 5.5
Linux >= 6.13.5 < 6.14
Linux 6.14

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org