CVE-2026-99097: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99097 is a denial-of-service vulnerability in the Linux kernel's Trusted Execution Environment (TEE) subsystem, specifically in the tee_dyn_shm_alloc_helper() function. The function fails to validate zero-sized shared memory allocation requests before passing them to alloc_pages_exact(), which can trigger a kernel panic on systems configured with panic_on_warn. The vulnerability was published on October 26, 2026, and affects Linux kernel versions starting from 6.10 up to the fixed releases. Fixed versions include 6.12.113, 6.18.57, 7.2.11, and 7.3. The CVSS base score is currently listed as 0.0 (Medium estimate by Feedly), reflecting its local, low-severity denial-of-service nature (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) in tee_dyn_shm_alloc_helper(): when a caller supplies size == 0, the derived nr_pages is 0, and alloc_pages_exact(0) internally calls get_order(0), which is documented as undefined behavior and returns BITS_PER_LONG - PAGE_SHIFT — an excessively large order value. This causes the page allocator to trip its order > MAX_PAGE_ORDER warning and fail the allocation; on kernels built with panic_on_warn, this results in a kernel panic that can prevent the system from booting. The vulnerability is triggerable via the TEE_IOC_SHM_ALLOC ioctl with a tee_ioctl_shm_alloc_data structure where size is set to 0. Notably, the register_shm_helper() code path already performs this zero-page-count check, making the omission in tee_dyn_shm_alloc_helper() an inconsistency in input validation (GitHub Advisory, Kernel Announce).

Successful exploitation results in a kernel panic and system unavailability, constituting a denial-of-service impact with no confidentiality or integrity consequences. On systems with panic_on_warn enabled, a single malicious ioctl call with a zero-sized allocation can crash the kernel and prevent the system from booting, requiring physical intervention to recover. The impact is limited to availability of the affected host; there is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). Exploitation requires local access to a system running an affected kernel version (6.10 through the fixed releases) with access to the TEE ioctl interface, which may be available to unprivileged users depending on TEE driver configuration. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Identify a vulnerable target: Confirm the target system is running Linux kernel version 6.10 or later (prior to the patched versions 6.12.113, 6.18.57, 7.2.11, or 7.3) with the TEE driver loaded and the TEE_IOC_SHM_ALLOC ioctl accessible.
2. Gain local access: Obtain local user access to the target system (unprivileged access may suffice depending on TEE device permissions, e.g., /dev/tee0).
3. Craft the malicious ioctl call: Write a program that opens the TEE device file and issues a TEE_IOC_SHM_ALLOC ioctl with a tee_ioctl_shm_alloc_data structure where the size field is set to 0.
4. Trigger the kernel panic: Submit the ioctl call. On kernels with panic_on_warn enabled, alloc_pages_exact(0) triggers the order > MAX_PAGE_ORDER warning, causing an immediate kernel panic and system crash (GitHub Advisory, Kernel Announce).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries showing WARNING: CPU: ... at mm/page_alloc.c with order > MAX_PAGE_ORDER; kernel panic traces referencing tee_dyn_shm_alloc_helper or alloc_pages_exact.
• Process: Unusual processes opening /dev/tee0 or /dev/teepriv0 and issuing ioctl calls with zero-sized parameters, particularly from non-TEE-related user applications.
• System: Unexpected system reboots or boot failures on panic_on_warn-enabled kernels, especially following access to TEE device nodes by unprivileged users.

The fix adds a zero-page-count check at the start of tee_dyn_shm_alloc_helper(), consistent with the validation already present in register_shm_helper(). Patched kernel versions are 6.12.113, 6.18.57, 7.2.11, and 7.3; administrators should upgrade to one of these releases. As a temporary workaround on unpatched systems, restricting access to the TEE device nodes (e.g., /dev/tee0) to trusted users or processes via file permissions or Linux Security Modules (SELinux/AppArmor) can reduce exposure (GitHub Advisory, Kernel Announce).