CVE-2026-53273
published 2026-06-25CVE-2026-53273: In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
tee: optee: prevent use-after-free when the client exits before the supplicant
Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the
client wait as killable so it can be interrupted during shutdown or
after a supplicant crash. This changes the original lifetime expectations:
the client task can now terminate while the supplicant is still processing
its request.
If the client exits first it removes the request from its queue and
kfree()s it, while the request ID remains in supp->idr. A subsequent
lookup on the supplicant path then dereferences freed memory, leading to
a use-after-free.
Serialise access to the request with supp->mutex:
* Hold supp->mutex in optee_supp_recv() and optee_supp_send() while
looking up and touching the request.
* Let optee_supp_thrd_req() notice that the client has terminated and
signal optee_supp_send() accordingly.
With these changes the request cannot be freed while the supplicant still
has a reference, eliminating the race.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 0180cf0373f84fff61b16f8c062553a13dd7cfca < 416259cb5bffecaaae5f76539deb535a8c1b2c34 | 416259cb5bffecaaae5f76539deb535a8c1b2c34 |
| linux | linux | >= 5.10.235 < 5.10.259 | 5.10.259 |
| linux | linux | >= 5.15.179 < 5.15.210 | 5.15.210 |
| linux | linux | >= 5.4.291 < 5.5 | 5.5 |
| linux | linux | >= 6.1.130 < 6.1.176 | 6.1.176 |
| linux | linux | >= 6.12.17 < 6.12.94 | 6.12.94 |
| linux | linux | >= 6.13.5 < 6.14 | 6.14 |
| linux | linux | >= 6.6.80 < 6.6.143 | 6.6.143 |
| linux | linux | >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < d5b57bb314d79e99bebb58a53588fa11dd4dbf69 | d5b57bb314d79e99bebb58a53588fa11dd4dbf69 |
| linux | linux | >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 373152c94e57e9592b68c100e224fbd943cfd608 | 373152c94e57e9592b68c100e224fbd943cfd608 |
| linux | linux | >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 387a926ee166814611acecb960207fe2f3c4fd3e | 387a926ee166814611acecb960207fe2f3c4fd3e |
| linux | linux | >= c0a9a948159153be145f9471435695373904ee6d < 724d0caffd4204b46f78efe22f18f8338031c6e1 | 724d0caffd4204b46f78efe22f18f8338031c6e1 |
| linux | linux | >= d61cc1a435e6894bfb0dd3370c6f765d2d12825d < 9a0dc9279d0907b198f205a693aedf696b08145d | 9a0dc9279d0907b198f205a693aedf696b08145d |
| linux | linux | >= ec18520f5edc20a00c34a8c9fdd6507c355e880f < ae847ab29ded2d7cece4d5970f0edefa4137bf2f | ae847ab29ded2d7cece4d5970f0edefa4137bf2f |
| linux | linux | >= fd9d2d6124c293e40797a080adf8a9c237efd8b8 < d366a01475f927402c96a3fe78bfc06b924fc87d | d366a01475f927402c96a3fe78bfc06b924fc87d |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wa
ghsa_unreviewed·2026-06-25
CVE-2026-53273 In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wa
In the Linux kernel, the following vulnerability has been resolved:
tee: optee: prevent use-after-free when the client exits before the supplicant
Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the
client wait as killable so it can be interrupted during shutdown or
after a supplicant crash. This changes the original lifetime expectations:
the client task can now terminate while the supplicant is still processing
its request.
If the client exits first it removes the request from its queue and
kfree()s it, while the request ID remains in supp->idr. A subsequent
lookup on the supplicant path then dereferences freed memory, leading to
a use-after-free.
Serialise access to the request with supp->mutex:
* Hold supp->mutex in optee_supp_recv() and optee_supp_send() while
l
Red Hat
kernel: tee: optee: prevent use-after-free when the client exits before the supplicant
vendor_redhat·2026-06-25
CVE-2026-53273 CWE-825 kernel: tee: optee: prevent use-after-free when the client exits before the supplicant
kernel: tee: optee: prevent use-after-free when the client exits before the supplicant
A flaw was found in the Linux kernel's Trusted Execution Environment (TEE) subsystem, specifically within the OP-TEE driver. This use-after-free vulnerability occurs when a client task terminates before its associated supplicant has finished processing a request. This timing issue can lead to the system attempting to access memory that has already been freed, potentially resulting in a denial of service or arbitrary code execution.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat En
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/373152c94e57e9592b68c100e224fbd943cfd608https://git.kernel.org/stable/c/387a926ee166814611acecb960207fe2f3c4fd3ehttps://git.kernel.org/stable/c/416259cb5bffecaaae5f76539deb535a8c1b2c34https://git.kernel.org/stable/c/724d0caffd4204b46f78efe22f18f8338031c6e1https://git.kernel.org/stable/c/9a0dc9279d0907b198f205a693aedf696b08145dhttps://git.kernel.org/stable/c/ae847ab29ded2d7cece4d5970f0edefa4137bf2fhttps://git.kernel.org/stable/c/d366a01475f927402c96a3fe78bfc06b924fc87dhttps://git.kernel.org/stable/c/d5b57bb314d79e99bebb58a53588fa11dd4dbf69
2026-06-25
Published