SB2026102664 - Improper Validation of Specified Quantity in Input in Linux kernel tee driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-99097)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel panic.

The vulnerability exists due to improper validation of a requested allocation size in tee_dyn_shm_alloc_helper() when handling shared memory allocation requests with a zero size. A local user can submit TEE_IOC_SHM_ALLOC with the size field of struct tee_ioctl_shm_alloc_data set to 0 to trigger an allocator warning and cause a denial of service.

The allocator warning terminates boot on kernels configured with panic_on_warn.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/65cb86860a80ffc6af897d53f5bd4b1733bca0ec
• https://git.kernel.org/stable/c/b7f925fd5226deb953c8dcdc9677d3fcc2717c00
• https://git.kernel.org/stable/c/c2a97703359e25ec7ef8b2b0ef32fb3982add90a
• https://git.kernel.org/stable/c/e5dc7af9c3a5373ee7a84959126e7dfa9e4ad50d