CVE-2026-53273 tee: optee: prevent use-after-free when the client exits before the supplicant
A use-after-free in the Linux kernel's OP-TEE driver allows attackers to execute arbitrary code or escalate privileges when a client exits prematurely.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53273?
CVE-2026-53273 is a high-severity use after free vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tee: optee: prevent use-after-free when the client exits before the supplicant
Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate while the supplicant is still processing its request.
If the client exits first it removes the request from its queue and kfree()s it, while the request ID remains in supp->idr. A subsequent lookup on the supplicant path then dereferences freed memory, leading to a use-after-free.
Serialise access to the request with supp->mutex:
* Hold supp->mutex in optee_supp_recv() and optee_supp_send() while looking up and touching the request. * Let optee_supp_thrd_req() notice that the client has terminated and signal optee_supp_send() accordingly.
With these changes the request cannot be freed while the supplicant still has a reference, eliminating the race.
Weakness: CWE-416
Which versions are affected by CVE-2026-53273?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53273?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-53273 being exploited?
There is no known exploitation of CVE-2026-53273 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53273, DEBIAN-CVE-2026-53273, GHSA-q972-3fgv-wchc, ROOT-OS-DEBIAN-11-CVE-2026-53273, ROOT-OS-DEBIAN-12-CVE-2026-53273, ROOT-OS-UBUNTU-2204-CVE-2026-53273 and 2 more.