In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in teedynshmallochelper()…
CVE-2026-99097
In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in teedynshmallochelper() teedynshmallochelper() derives nrpages from a caller-supplied size and passes it to allocpagesexact() without checking it. For size == 0 nrpages is 0, and allocpagesexact(0) calls getorder(0), which is documented as undefined and returns BITSPERLONG - PAGESHIFT. The page allocator then trips its order > MAXPAGEORDER warning and fails the allocation; on a paniconwarn kernel that ends the boot. This can be triggered by TEEIOCSHMALLOC with struct teeioctlshmallocdata where size is 0. Reject a zero page count, as registershmhelper() already does for the register path.
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 26 October 2026
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
At the source
References
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99097