tee_dyn_shm_alloc_helper() in the Linux kernel allocates shared memory for Trusted Execution Environment services. When a caller supplies a size of zero, the function calculates a zero page count and passes it to alloc_pages_exact(), which in turn calls an undefined get_order(0). The kernel then issues an order‑greater‑than‑maximum warning and, on a panic_on_warn configuration, triggers a kernel panic. This results in an immediate loss of service where the whole system reboots or halts.

The vulnerability applies to the Linux kernel across all major distributions, regardless of vendor. No specific kernel version list is provided, so any kernel build that has not applied the patch is potentially affected.

The vector requires a process that can perform the TEE_IOC_SHM_ALLOC ioctl with a zero size, which typically means a privileged or malicious TEE driver. While the EPSS score is not available, the impact is severe; a single faulty request can cause a kernel panic and system downtime. The issue is not listed in the CISA KEV catalog, but the lack of a mitigation in the wild means that any unpatched system remains at risk.