CVE-2026-53273: Linux Kernel TEE OptEE Use-After-Free Local Privilege Escalation

Technical summary

CVE-2026-53273 is a use-after-free (CWE-416) in the Linux kernel's TEE OptEE driver. The root cause is a synchronization gap between client and supplicant processes introduced by commit 70b0d6b0a199. When a client task terminates while the supplicant is still processing a request, the client removes the request from its queue and deallocates it via kfree(). However, the request ID remains indexed in supp->idr. A subsequent supplicant lookup dereferences the freed memory. The fix involves serializing access via supp->mutex in optee_supp_recv() and optee_supp_send() to ensure the request cannot be freed while the supplicant holds a reference, and allowing optee_supp_thrd_req() to detect client termination and signal appropriately.

Business impact

This vulnerability enables local privilege escalation on affected Linux systems. An unprivileged user can trigger the race condition by crafting a TEE client that exits prematurely during a supplicant request, potentially leading to arbitrary kernel code execution. Systems relying on TEE for security-critical operations—such as DRM, secure boot verification, or trusted key storage—face elevated risk. The impact is contained to local attack scenarios and requires user-level access, but successful exploitation grants full kernel-level privileges.

Affected systems

The Linux kernel is affected across multiple versions. The vulnerability impacts any kernel build that includes the TEE OptEE subsystem with commit 70b0d6b0a199 applied. Systems using ARM TrustZone, mobile platforms (Android, Linux phones), embedded devices, and servers leveraging TEE for cryptographic or DRM operations are at risk. Desktop and server distributions that enable TEE support in their kernel configurations are potentially exposed. Verify your kernel version and TEE module status against vendor advisories to confirm exposure.

Exploitability

The vulnerability requires local access and is not currently known to be actively exploited in the wild (KEV status is not designated). Exploitation is moderately complex: an attacker must write a TEE client that reliably triggers the race condition between client exit and supplicant processing. Once triggered, the use-after-free may lead to kernel memory corruption, information disclosure, or code execution. The CVSS 3.1 score of 7.8 (HIGH) reflects local attack vector, low complexity, and high impact across confidentiality, integrity, and availability.

Remediation

Apply a Linux kernel patch that implements mutex-based serialization in the TEE OptEE driver. The fix ensures that request objects remain valid for the supplicant's entire lifecycle. Verify the patch version from your Linux distributor or kernel.org. Most major distributions (Red Hat, Ubuntu, Debian, etc.) will backport the fix to their supported kernel branches. Update to a patched kernel version and reboot. If immediate patching is not feasible, disable TEE OptEE support in your kernel configuration if it is not essential to your operations.

Patch guidance

Consult your Linux distribution's security advisory and kernel update channels. Vendors like Red Hat, Canonical (Ubuntu), and Debian publish patches tied to CVE-2026-53273 with specific kernel versions. Apply the latest kernel update from your distribution. For rolling distributions, ensure your kernel is fully up to date. For long-term support kernels, verify that your LTS branch includes the fix. Test the patched kernel in a non-production environment before deployment. Rebooting into the patched kernel is required for the fix to take effect.

Detection guidance

Monitor kernel logs and crash reports for use-after-free warnings in the TEE OptEE subsystem, typically logged as BUG or KASAN (Kernel Address Sanitizer) errors if KASAN is enabled. Check for unexpected kernel panics or oopses referencing optee_supp_recv(), optee_supp_send(), or optee_supp_thrd_req(). On systems with KASAN or CONFIG_DEBUG_OBJECTS enabled, detection is more straightforward. Endpoint detection and response (EDR) solutions can monitor for abnormal TEE client behavior or rapid process termination patterns. Kernel auditing (auditd) can track TEE subsystem access, though not the race condition itself.

Why prioritize this

This vulnerability merits high priority due to its HIGH CVSS score (7.8), the potential for local privilege escalation, and widespread kernel distribution. Although not yet exploited in the wild, the race condition is deterministic and can be reliably triggered by a local attacker. Systems in multi-tenant environments, shared hosting, or with untrusted local users present elevated risk. Organizations deploying TEE for sensitive operations should prioritize patching. The local-only attack vector reduces urgency slightly compared to remote RCE vulnerabilities, but the high impact justifies expedited remediation.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector (Local) – requires direct system access; Attack Complexity (Low) – race condition is reproducible without specialized tooling; Privileges Required (Low) – unprivileged user can trigger; User Interaction (None) – automatic upon client termination; Scope (Unchanged) – impact limited to the affected system; Confidentiality (High) – kernel memory can be read; Integrity (High) – kernel state can be modified; Availability (High) – kernel crash or DoS possible. The score appropriately captures local privilege escalation severity.

Frequently asked questions