CVE-2025-40031 tee: fix register_shm_helper()
A local attacker can trigger a NULL pointer dereference in the Linux kernel TEE driver via a specific ioctl call, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40031?
CVE-2025-40031 is a vulnerability in Linux, published on 28 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tee: fix register_shm_helper()
In register_shm_helper(), fix incorrect error handling for a call to iov_iter_extract_pages(). A case is missing for when iov_iter_extract_pages() only got some pages and return a number larger than 0, but not the requested amount.
This fixes a possible NULL pointer dereference following a bad input from ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.
Which versions are affected by CVE-2025-40031?
How do I fix CVE-2025-40031?
Apply the vendor's patch.
Is CVE-2025-40031 being exploited?
There is no known exploitation of CVE-2025-40031 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40031, DEBIAN-CVE-2025-40031, GHSA-j3cc-8mgg-5gq2, ROOT-OS-DEBIAN-13-CVE-2025-40031, ROOT-OS-UBUNTU-2404-CVE-2025-40031, UBUNTU-CVE-2025-40031.