{"id":"CVE-2026-53273","revision":"097d6aa7e4bb483aa9967de34824ba64","records":[{"revision":"097d6aa7e4bb483aa9967de34824ba64","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53273","aliases":[],"title":"tee: optee: prevent use-after-free when the client exits before the supplicant","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntee: optee: prevent use-after-free when the client exits before the supplicant\n\nCommit 70b0d6b0a199 (\"tee: optee: Fix supplicant wait loop\") made the\nclient wait as killable so it can be interrupted during shutdown or\nafter a supplicant crash. This changes the original lifetime expectations:\nthe client task can now terminate while the supplicant is still processing\nits request.\n\nIf the client exits first it removes the request from its queue and\nkfree()s it, while the request ID remains in supp->idr. A subsequent\nlookup on the supplicant path then dereferences freed memory, leading to\na use-after-free.\n\nSerialise access to the request with supp->mutex:\n\n  * Hold supp->mutex in optee_supp_recv() and optee_supp_send() while\n    looking up and touching the request.\n  * Let optee_supp_thrd_req() notice that the client has terminated and\n    signal optee_supp_send() accordingly.\n\nWith these changes the request cannot be freed while the supplicant still\nhas a reference, eliminating the race.","state":0,"publishedAt":"2026-06-25T08:39:57.811+00:00","modifiedAt":"2026-10-19T19:57:33.173+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/tee/optee/supp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"0180cf0373f84fff61b16f8c062553a13dd7cfca\",\n                            \"lessThan\": \"416259cb5bffecaaae5f76539deb535a8c1b2c34\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c0a9a948159153be145f9471435695373904ee6d\",\n                            \"lessThan\": \"724d0caffd4204b46f78efe22f18f8338031c6e1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec18520f5edc20a00c34a8c9fdd6507c355e880f\",\n                            \"lessThan\": \"ae847ab29ded2d7cece4d5970f0edefa4137bf2f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d61cc1a435e6894bfb0dd3370c6f765d2d12825d\",\n                            \"lessThan\": \"9a0dc9279d0907b198f205a693aedf696b08145d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fd9d2d6124c293e40797a080adf8a9c237efd8b8\",\n                            \"lessThan\": \"d366a01475f927402c96a3fe78bfc06b924fc87d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"70b0d6b0a199c5a3ee6c72f5e61681ed6f759612\",\n                            \"lessThan\": \"d5b57bb314d79e99bebb58a53588fa11dd4dbf69\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"70b0d6b0a199c5a3ee6c72f5e61681ed6f759612\",\n                            \"lessThan\": \"373152c94e57e9592b68c100e224fbd943cfd608\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"70b0d6b0a199c5a3ee6c72f5e61681ed6f759612\",\n                            \"lessThan\": \"387a926ee166814611acecb960207fe2f3c4fd3e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3eb4911364c764572e9db4ab900a57689a54e8ce\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"21234efe2a8474a6d2d01ea9573319de7858ce44\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.235\",\n                            \"lessThan\": \"5.10.259\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.179\",\n                            \"lessThan\": \"5.15.210\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.130\",\n                            \"lessThan\": \"6.1.176\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.80\",\n                            \"lessThan\": \"6.6.143\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.17\",\n                            \"lessThan\": \"6.12.94\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.291\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.5\",\n                            \"lessThan\": \"6.14\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/tee/optee/supp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.259\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.176\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.143\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.94\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.36\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.13\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/416259cb5bffecaaae5f76539deb535a8c1b2c34","https://git.kernel.org/stable/c/724d0caffd4204b46f78efe22f18f8338031c6e1","https://git.kernel.org/stable/c/ae847ab29ded2d7cece4d5970f0edefa4137bf2f","https://git.kernel.org/stable/c/9a0dc9279d0907b198f205a693aedf696b08145d","https://git.kernel.org/stable/c/d366a01475f927402c96a3fe78bfc06b924fc87d","https://git.kernel.org/stable/c/d5b57bb314d79e99bebb58a53588fa11dd4dbf69","https://git.kernel.org/stable/c/373152c94e57e9592b68c100e224fbd943cfd608","https://git.kernel.org/stable/c/387a926ee166814611acecb960207fe2f3c4fd3e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53273","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53273","identifiers":["CVE-2026-53273"]},"retained":false,"historicalAffected":[]}],"coverage":[]}