CVE-2026-10420: Samsung mTower untrusted pointer dereference in syscalls

CVE-2026-10420 · Severity: medium · CVSS 5.5 · Published 2026-09-01

Samsung mTower is a trusted execution environment (TEE) component that provides a secure processing space isolated from the main operating system. An untrusted pointer dereference vulnerability allows a malicious or buggy trusted application to pass specially crafted pointer values to syscall handlers, potentially causing out-of-bounds memory access and compromising the integrity of the secure world. This could enable attackers to bypass security boundaries, leak sensitive data, or escalate privileges within the TEE.

Technologies: Samsung mTower. Vendors: Samsung.

Quick answers

Is CVE-2026-10420 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10420 being exploited in the wild.
How severe is CVE-2026-10420?
Medium severity, with a CVSS score of 5.5, published 1 September 2026.
Which products and versions are affected?
Samsung mTower before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.
Is there a fix for CVE-2026-10420?
A patch was published on 2026-08-05: Fix merged in PR #252 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10420 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-10420?
Check whether you run Samsung mTower at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in mTower's copy helper functions (tee_svc_copy_to_user/tee_svc_copy_from_user) and crypto syscalls (utee_hash_update/final, utee_cipher_init, cipher_update, copy_in_attrs) that dereference or memcpy trusted application (TA)-supplied pointer ranges without proper validation. The root cause is that the tee_mmu_check_access_rights() guard was commented out or missing at multiple call sites. A malicious TA can pass NULL pointers, invalid ranges, or address-space-wrapping ranges to trigger out-of-bounds memory access in the secure kernel. The fix implements proper pointer validation in tee_mmu_check_access_rights() to reject NULL+len and wrapping ranges, then restores the guard at all vulnerable call sites. No per-TA MMU/MPU context means all access checks use TEE_MEMORY_ACCESS_ANY_OWNER, making strict bounds checking essential.

Affected products

  • Samsung mTower before 102d3dc75cf8e58e68e4bea54ae3c803992c91be

Timeline

  • 2026-09-01: disclosed
  • 2026-08-05: patched: Fix merged in PR #252

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.