CVE-2025-40031

In the Linux kernel, the following vulnerability has been resolved:

tee: fix register_shm_helper()

In register_shm_helper(), fix incorrect error handling for a call to iov_iter_extract_pages(). A case is missing for when iov_iter_extract_pages() only got some pages and return a number larger than 0, but not the requested amount.

This fixes a possible NULL pointer dereference following a bad input from ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.

The patch fixes a NULL pointer dereference in register_shm_helper() when iov_iter_extract_pages() returns a partial success (len > 0 but fewer pages than requested). The old code didn’t handle this case, leading to a possible NULL deref upon bad userspace input via ioctl(TEE_IOC_SHM_REGISTER) (e.g., partially unmapped buffers). Impact is local kernel crash/DoS only.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.