CVE-2025-40031

Root

Cause

The vulnerability resides in register_shm_helper() within the Linux kernel's TEE (Trusted Execution Environment) subsystem. The function calls iov_iter_extract_pages() to pin user-space pages for shared memory registration. However, the error handling only covers cases where the call returns a negative error or zero value. If iov_iter_extract_pages() returns a positive number less than the requested page count—meaning it extracted some pages but not all—the code proceeds without checking this incomplete result. This leads to a NULL pointer dereference because subsequent operations assume all pages are validly extracted [1][2].

Attack

Vector

An attacker with the ability to issue the ioctl(TEE_IOC_SHM_REGISTER) call can trigger this bug. The attacker provides a buffer that is partially unmapped (e.g., a buffer spanning mapped and unmapped memory regions). When iov_iter_extract_pages() encounters the unmapped part, it stops early and returns the number of pages successfully extracted. Because the code does not examine this return value properly, it treats the operation as successful and attempts to access pages that were never pinned, leading to a NULL pointer dereference in kernel memory [1]. No special privileges beyond the ability to use the TEE device are required, though the device may be restricted to certain user groups.

Impact

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (denial of service). In some configurations, this could potentially be leveraged for privilege escalation or other exploits, but the primary impact documented is a denial-of-service condition. The bug is triggered by a crafted ioctl input that does not require physical access or unusual network position [1].

Mitigation

The fix is included in Linux kernel stable updates. The commit [1] corrects the error handling by checking if the extracted page count is less than the requested amount and returning an appropriate error (e.g., -EFAULT). All upstream stable kernel versions that include the vulnerable code should be patched. Users are advised to update their kernels to incorporate the fix. No workaround is provided aside from restricting access to the TEE device node (usually /dev/tee*) to trusted users.