Vulnerability feed

Executive summary

The advisory describes a flaw in the Linux kernel's OP-TEE trusted execution driver, where TEE devices were registered before the driver was fully set up, so user space or kernel code could use them during initialization. The advisory does not state a severity rating, and it does not describe any attack in the wild. The fix is a kernel code change that moves device registration to the end of driver setup, and the advisory does not mention any separate workaround.

Technical summary

The weakness is a race condition, where tee_device_register() ran before struct optee was initialized, leaving mutexes, completions, the RPMB mutex, the message argument cache and the context pointer uninitialized, which can lead to use of uninitialized locks and a NULL pointer dereference. The advisory says the devices are reachable from user space via tee_open() and from kernel space via tee_client_open_context() during this window, but it does not state the required privileges or any other preconditions. The fix moves both tee_device_register() calls in optee_probe (smc_abi.c) and optee_ffa_probe (ffa_abi.c) to after initialization, with matching error label changes. The advisory does not state affected or fixed version numbers, a CVSS score, or any workaround, and it gives no detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/262062c01f5a817…8bf6eacb7c6ffdc7018d

Score

No CVSS score published.

Affects

LinuxOP-TEELinuxLinux kernelOP-TEE driver