Linux Kernel TEE Component Vulnerability in Memory Allocation

CVE-2026-99097

What is CVE-2026-99097?

A vulnerability exists in the Linux kernel's TEE (Trusted Execution Environment) component related to memory allocation. When the function tee_dyn_shm_alloc_helper() handles a zero-sized allocation request, it incorrectly derives the number of pages to allocate without validating the size input. This flaw can lead to critical errors during the allocation process, potentially causing system instability and failure during boot on a panic_on_warn kernel. It is essential to implement input validation for page counts to prevent such issues and ensure robust kernel functionality.

References