{"id":70546,"date":"2025-09-19T21:32:41","date_gmt":"2025-09-19T18:02:41","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-39865-tee-fix-null-pointer-dereference-in-tee_shm_put\/"},"modified":"2025-09-19T21:32:41","modified_gmt":"2025-09-19T18:02:41","slug":"cve-2025-39865-tee-fix-null-pointer-dereference-in-tee_shm_put","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-39865-tee-fix-null-pointer-dereference-in-tee_shm_put\/","title":{"rendered":"CVE-2025-39865 – tee: fix NULL pointer dereference in tee_shm_put"},"content":{"rendered":"

CVE ID : <\/strong>CVE-2025-39865
\n
\nPublished : <\/strong> Sept. 19, 2025, 4:15 p.m. | 48\u00a0minutes ago
\n
\nDescription : <\/strong>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n

tee: fix NULL pointer dereference in tee_shm_put<\/p>\n

tee_shm_put have NULL pointer dereference:<\/p>\n

__optee_disable_shm_cache –>
\n\tshm = reg_pair_to_ptr(…);\/\/shm maybe return NULL
\n tee_shm_free(shm); –>
\n\t\ttee_shm_put(shm);\/\/crash<\/p>\n

Add check in tee_shm_put to fix it.<\/p>\n

panic log:
\nUnable to handle kernel paging request at virtual address 0000000000100cca
\nMem abort info:
\nESR = 0x0000000096000004
\nEC = 0x25: DABT (current EL), IL = 32 bits
\nSET = 0, FnV = 0
\nEA = 0, S1PTW = 0
\nFSC = 0x04: level 0 translation fault
\nData abort info:
\nISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
\nCM = 0, WnR = 0, TnD = 0, TagAccess = 0
\nGCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
\nuser pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000
\n[0000000000100cca] pgd=0000000000000000, p4d=0000000000000000
\nInternal error: Oops: 0000000096000004 [#1] SMP
\nCPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ——- —-
\n6.6.0-39-generic #38
\nSource Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07
\nHardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0
\n10\/26\/2022
\npstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=–)
\npc : tee_shm_put+0x24\/0x188
\nlr : tee_shm_free+0x14\/0x28
\nsp : ffff001f98f9faf0
\nx29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000
\nx26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048
\nx23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88
\nx20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff
\nx17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003
\nx14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101
\nx11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c
\nx8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000
\nx5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
\nx2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca
\nCall trace:
\ntee_shm_put+0x24\/0x188
\ntee_shm_free+0x14\/0x28
\n__optee_disable_shm_cache+0xa8\/0x108
\noptee_shutdown+0x28\/0x38
\nplatform_shutdown+0x28\/0x40
\ndevice_shutdown+0x144\/0x2b0
\nkernel_power_off+0x3c\/0x80
\nhibernate+0x35c\/0x388
\nstate_store+0x64\/0x80
\nkobj_attr_store+0x14\/0x28
\nsysfs_kf_write+0x48\/0x60
\nkernfs_fop_write_iter+0x128\/0x1c0
\nvfs_write+0x270\/0x370
\nksys_write+0x6c\/0x100
\n__arm64_sys_write+0x20\/0x30
\ninvoke_syscall+0x4c\/0x120
\nel0_svc_common.constprop.0+0x44\/0xf0
\ndo_el0_svc+0x24\/0x38
\nel0_svc+0x24\/0x88
\nel0t_64_sync_handler+0x134\/0x150
\nel0t_64_sync+0x14c\/0x15
\n
\nSeverity:<\/strong> 0.0 | NA
\n
\nVisit the link for more details, such as CVSS details, affected products, timeline, and more…<\/p>\n","protected":false},"excerpt":{"rendered":"

CVE ID : CVE-2025-39865 Published : Sept. 19, 2025, 4:15 p.m. | 48\u00a0minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache –> shm = reg_pair_to_ptr(…);\/\/shm maybe return NULL tee_shm_free(shm); –> tee_shm_put(shm);\/\/crash Add check in tee_shm_put to fix …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-70546","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=70546"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70546\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=70546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=70546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=70546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}