The Linux kernel vulnerability CVE-2026-53210 involves a memory leak in the TEE subsystem's register_shm_helper() function. Specifically, the function allocates shared memory before calling iov_iter_npages(), which returns the number of pages for the memory operation. If iov_iter_npages() returns zero (indicating zero length), the function erroneously jumps to an error handling label err_ctx_put without freeing the allocated shared memory, causing a leak. This can be triggered by the TEE_IOC_SHM_REGISTER ioctl when the length field in tee_ioctl_shm_register_data is zero. The correct behavior is to jump to err_free_shm to free the allocated memory, which has been fixed in the kernel.

The vulnerability results in a shared memory leak within the Linux kernel's TEE subsystem when processing zero-length shared memory registration requests. While it does not affect confidentiality or integrity, it impacts availability by potentially exhausting kernel memory resources over time. There are no known exploits in the wild. The CVSS 3.1 vector rates the impact as no confidentiality or integrity impact but high availability impact (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official Linux kernel security advisories for updates addressing this issue. Avoid sending zero-length shared memory registration requests to the TEE subsystem as a temporary mitigation if feasible.