Executive brief
A vulnerability was identified in the Linux kernel's OP-TEE driver, which manages secure communication between standard applications and trusted environments. Under specific conditions, if a user application terminates while a background service is still processing its request, the system may attempt to access memory that has already been cleared. This could lead to system instability, crashes, or potential unauthorized access to kernel resources.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/tee/optee/supp.c within the Linux kernel. The issue stems from a race condition introduced by making client waits killable; if a client task is interrupted (e.g., during shutdown or a crash) while the supplicant is still processing a request, the client may kfree() the request object while its ID remains active in the supplicant's IDR. A subsequent lookup by the supplicant results in a dereference of the freed memory. The fix involves serializing access to the request using the supplicant mutex and implementing a mechanism to signal when a client has terminated during processing.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2026-02-16: other: Patch authored
- 2026-03-02: patched: Initial patch committed to maintainer tree
- 2026-06-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/373152c94e57e9592b68c100e224fbd943cfd608
- https://git.kernel.org/stable/c/387a926ee166814611acecb960207fe2f3c4fd3e
- https://git.kernel.org/stable/c/416259cb5bffecaaae5f76539deb535a8c1b2c34
- https://git.kernel.org/stable/c/724d0caffd4204b46f78efe22f18f8338031c6e1
- https://git.kernel.org/stable/c/9a0dc9279d0907b198f205a693aedf696b08145d
- https://git.kernel.org/stable/c/ae847ab29ded2d7cece4d5970f0edefa4137bf2f
- https://git.kernel.org/stable/c/d366a01475f927402c96a3fe78bfc06b924fc87d