The Linux kernel has a flaw in the register_shm_helper routine where shared memory is allocated before checking the number of pages. When the I/O vector page count returns zero, the code jumps to a cleanup path that fails to release the allocated memory, resulting in a memory leak. This deficiency can lead to gradual exhaustion of kernel memory, eventually causing system instability or a denial of service. The weakness is characterized by an unchecked allocation without proper deallocation, aligning with the CWE–401 Memory Leak identifier.

The vulnerability affects all Linux kernel builds that include the register_shm_helper implementation without the recent git patch, regardless of specific distribution or version. Users of the TEE driver on any Linux kernel not yet updated to incorporate this fix are potentially impacted. No explicit version range is provided, so any kernel installation predating the commit is considered at risk.

An attacker can trigger the bug by issuing the TEE_IOC_SHM_REGISTER ioctl with a zero‐length request to the TEE driver, a capability typically limited to privileged or authenticated users. Repeated exploitation would progressively consume kernel memory, degrading performance and potentially leading to a crash or reboot. The vulnerability is not listed in the CISA KEV catalog and its EPSS score is currently unavailable, but the lack of a patch in the kernel implies a moderate to high exploitation risk for affected systems. Applying the kernel update that corrects the memory handling is the most effective countermeasure.