CVE-2026-53273High· 7.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as kil…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Last analysed / modified upstream
0.1% → 0.2%
In the Linux kernel, the following vulnerability has been resolved:
tee: optee: prevent use-after-free when the client exits before the supplicant
Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request.
If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free.
Serialise access to the request with supp->mutex:
With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race.
Linux >= 0180cf0373f84fff61b16f8c062553a13dd7cfca < 416259cb5bffecaaae5f76539deb535a8c1b2c34Linux >= c0a9a948159153be145f9471435695373904ee6d < 724d0caffd4204b46f78efe22f18f8338031c6e1Linux >= ec18520f5edc20a00c34a8c9fdd6507c355e880f < ae847ab29ded2d7cece4d5970f0edefa4137bf2fLinux >= d61cc1a435e6894bfb0dd3370c6f765d2d12825d < 9a0dc9279d0907b198f205a693aedf696b08145dLinux >= fd9d2d6124c293e40797a080adf8a9c237efd8b8 < d366a01475f927402c96a3fe78bfc06b924fc87dLinux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < d5b57bb314d79e99bebb58a53588fa11dd4dbf69Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 373152c94e57e9592b68c100e224fbd943cfd608Linux >= 70b0d6b0a199c5a3ee6c72f5e61681ed6f759612 < 387a926ee166814611acecb960207fe2f3c4fd3eLinux 3eb4911364c764572e9db4ab900a57689a54e8ceLinux 21234efe2a8474a6d2d01ea9573319de7858ce44Linux >= 5.10.235 < 5.10.259Linux >= 5.15.179 < 5.15.210Linux >= 6.1.130 < 6.1.176Linux >= 6.6.80 < 6.6.143Linux >= 6.12.17 < 6.12.94Linux >= 5.4.291 < 5.5Linux >= 6.13.5 < 6.14Linux 6.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-38564High· 7.8bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
CVE-2026-99092Noneriscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99089NoneASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99093Nonemm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99088Nonenet: openvswitch: validate transport header presence in set_ipv6_addr
CVE-2026-99090Nonedrm/amdgpu: serialize vblank counter reads against GPU reset