Executive brief
The Linux kernel's OP-TEE (Open Portable Trusted Execution Environment) driver contains a null pointer dereference vulnerability in memory allocation handling. Under memory pressure conditions, a memory allocation call can fail and return NULL, but the code did not validate this pointer before dereferencing it, potentially causing a kernel crash or denial of service.
Technical details
This is a null pointer dereference vulnerability in the optee_ffa_lend_protmem() function within drivers/tee/optee/ffa_abi.c. The vulnerable code calls kzalloc_objs() to allocate memory but fails to check if the allocation succeeded (returned non-NULL) before dereferencing the pointer in a subsequent loop. Under memory pressure, the allocation can fail and return NULL, leading to a kernel crash when the code attempts to access mem_attr[n]. The fix adds a simple NULL check immediately after the allocation: if (!mem_attr) return -ENOMEM;. This requires local access to trigger (likely via OP-TEE TEE client calls) and has been patched in stable kernel releases as of June–August 2026.
Affected products
- Linux Linux kernel multiple versions from 2.6 onwards (patched in 2026-06-29 and later stable releases)
Timeline
- 2026-08-26: disclosed
- 2026-06-29: patched