CVE-2022-50080 tee: add overflow check in register_shm_helper()

Medium 5.5 Published 18 Jun 2025 Updated 11 May 2026

An integer overflow in the Linux kernel TEE driver allows local attackers to trigger a NULL pointer dereference, causing a system crash.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-50080?

CVE-2022-50080 is a medium-severity vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

tee: add overflow check in register_shm_helper()

With special lengths supplied by user space, register_shm_helper() has an integer overflow when calculating the number of pages covered by a supplied user space memory region.

This causes internal_get_user_pages_fast() a helper function of pin_user_pages_fast() to do a NULL pointer dereference:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Modules linked in: CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11 Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pc : internal_get_user_pages_fast+0x474/0xa80 Call trace: internal_get_user_pages_fast+0x474/0xa80 pin_user_pages_fast+0x24/0x4c register_shm_helper+0x194/0x330 tee_shm_register_user_buf+0x78/0x120 tee_ioctl+0xd0/0x11a0 __arm64_sys_ioctl+0xa8/0xec invoke_syscall+0x48/0x114

Fix this by adding an an explicit call to access_ok() in tee_shm_register_user_buf() to catch an invalid user space address early.

Weakness: CWE-476

Which versions are affected by CVE-2022-50080?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2022-50080?

Apply the vendor's patch.

Is CVE-2022-50080 being exploited?

There is no known exploitation of CVE-2022-50080 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-50080, GHSA-cqg3-9qgq-grfj, UBUNTU-CVE-2022-50080.