Use-After-Free Vulnerability in Linux Kernel Related to OP-TEE Supplicant

CVE-2026-53273

What is CVE-2026-53273?

The Linux kernel has unveiled a use-after-free vulnerability linked to the OP-TEE supplicant mechanism. This flaw arises when a client exits prematurely, leading to freed memory being referenced. The issue stems from the changes made in the commit 70b0d6b0a199, which adjusted the client’s behavior during shutdown, allowing it to terminate while the supplicant is still processing the request. To mitigate the risks, access to the request should be serialized using a mutex, ensuring that the request cannot be freed while still in use by the supplicant. This adjustment effectively eliminates the race condition that could be exploited by attackers.

References