CVE-2026-53273

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tee: optee: prevent use-after-free when the client exits before the supplicant<br /> <br /> Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the<br /> client wait as killable so it can be interrupted during shutdown or<br /> after a supplicant crash. This changes the original lifetime expectations:<br /> the client task can now terminate while the supplicant is still processing<br /> its request.<br /> <br /> If the client exits first it removes the request from its queue and<br /> kfree()s it, while the request ID remains in supp-&gt;idr. A subsequent<br /> lookup on the supplicant path then dereferences freed memory, leading to<br /> a use-after-free.<br /> <br /> Serialise access to the request with supp-&gt;mutex:<br /> <br /> * Hold supp-&gt;mutex in optee_supp_recv() and optee_supp_send() while<br /> looking up and touching the request.<br /> * Let optee_supp_thrd_req() notice that the client has terminated and<br /> signal optee_supp_send() accordingly.<br /> <br /> With these changes the request cannot be freed while the supplicant still<br /> has a reference, eliminating the race.