Executive brief
A configuration error in the Linux kernel for Xilinx ZynqMP chips can cause system instability and memory access violations. The issue occurs because the kernel's hardware description conflicts with the bootloader's security settings, preventing proper memory protection for the OP-TEE trusted execution environment. This could lead to system crashes or unauthorized access to protected memory areas.
Technical details
The vulnerability stems from the manual inclusion of an 'optee' node in the zynqmp.dtsi device tree file. In ZynqMP systems, U-Boot is responsible for dynamically injecting both the OP-TEE firmware node and its associated reserved-memory nodes into the kernel's device tree. However, U-Boot's injection logic is bypassed if an 'optee' node already exists in the static device tree. This failure to reserve memory correctly results in the kernel potentially accessing memory regions intended for the Trusted Execution Environment (TEE), leading to runtime memory access violations. The fix involves reverting the commit that added the static node, allowing U-Boot to handle the memory reservation correctly.
Affected products
- Linux Linux Kernel 6.9 to 6.12.74, 6.13 to 6.18.15, 6.19 to 6.19.5
Timeline
- 2025-12-15: patched: Initial fix commit c197179990124f991fca220d97fac56779a02c6d
- 2026-05-08: disclosed: CVE published