Executive brief
OP-TEE is a secure operating system used on Arm processors to protect sensitive data and run trusted applications. A flaw in how it manages shared memory allows a local user to cause a resource leak that slowly consumes the system's secure memory. Over time, this will cause the secure environment to become unresponsive, potentially disrupting security functions and requiring a full system reboot to restore service.
Technical details
A resource leak exists in OP-TEE's shared memory cleanup logic within 'core/tee/entry_std.c'. The function 'cleanup_shm_refs()' fails to apply the 'OPTEE_MSG_ATTR_TYPE_MASK' bitmask to parameter attributes when processing non-contiguous memory parameters from a normal-world caller. This causes the system to skip the 'mobj_put()' call, leading to a persistent reference leak of 'mobj_reg_shm' objects. The vulnerability affects non-FF-A configurations supporting non-contiguous, non-secure shared memory. An attacker with local access can trigger this leak repeatedly to exhaust the secure-world heap, eventually causing a denial-of-service. The issue is fixed in version 4.11.0.
Affected products
- OP-TEE optee_os >= 3.3.0, < 4.11.0
Timeline
- 2026-03-23: other: Report received by vendor
- 2026-06-23: patched: Fix published
- 2026-06-23: advisory: GitHub advisory published
- 2026-07-06: disclosed: NVD publication date