{"id":"CVE-2026-99024","kind":"vulnerability","aliases":["CVE-2026-99024"],"related":[],"title":"Linux kernel OP-TEE driver: device opened before init lets local users crash or take over","description":"In the Linux kernel, the following vulnerability has been resolved:\n\noptee: register TEE devices only once fully initialized\n\noptee_probe() called tee_device_register() on both the client and the\nsupplicant device before the rest of struct optee had been initialized.\n\ntee_device_register() calls cdev_device_add(), which does two things at\nonce: it creates /dev/tee0 and /dev/teepriv0, and it links the device\ninto the tee class so that class_find_device() can find it. From that\nmoment on the device is reachable both from user space via tee_open()\nand from kernel space via tee_client_open_context(). The only gate in\nteedev_open() is tee_device_get(), which merely checks that\nteedev->desc is non-NULL, which was already set by tee_device_alloc().\nTherefore, there is effectively no gate at all.\n\nA context opened in that window can run against a struct optee where\n\n  - optee->call_queue.mutex is not initialized by optee_cq_init()\n  - optee->supp mutex and completions is not initialized by\n    optee_supp_init()\n  - optee->rpmb_dev_mutex is not initialized yet,\n  - the message argument cache is not initialized by\n    optee_shm_arg_cache_init()\n  - optee->ctx is still NULL\n\nAny open session or invoke during this window takes uninitialized\nmutexes and dereferences a NULL pointer.\n\nFix it by moving both tee_device_register() calls down to the point\nwhere all of struct optee is set up.\n\n[JW: adding fixes and cc]","summary":"The OP-TEE driver in the Linux kernel registers its TEE device nodes before its internal structures and locks are set up, so a context opened in that window uses uninitialized mutexes and a NULL pointer. The sources do not state what an attacker gets beyond a likely kernel crash or memory corruption.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm","linux-kernel","optee","runtime"],"not_affected_if":["no-optee-driver"],"how_to_check":"- `uname -r` and compare against the kernel release that contains the fix, which the sources do not name\n- Check whether the OP-TEE driver is in use: `ls /dev/tee0 /dev/teepriv0`\n- unknown for a definitive version list","fix":"- Update the Linux kernel to a release that includes the upstream commit moving tee_device_register() calls after full initialization (version unknown from sources)\n- unknown for a specific version number","status":"open","published_at":"2026-10-23T13:17:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:36+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:55:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit moving tee_device_register() calls after full initialization (version unknown from sources)\n- unknown for a specific version number","reach":"local","title":"Linux kernel OP-TEE driver: device opened before init lets local users crash or take over","impact":"medium","summary":"The OP-TEE driver in the Linux kernel registers its TEE device nodes before its internal structures and locks are set up, so a context opened in that window uses uninitialized mutexes and a NULL pointer. The sources do not state what an attacker gets beyond a likely kernel crash or memory corruption.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","arm","optee"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; likely kernel crash or memory corruption from a local open","analyst_note":"Confirm affected and fixed kernel version ranges from the NVD entry or the upstream stable commit, and whether a local unprivileged user can open /dev/tee0 to trigger it.","how_to_check":"- `uname -r` and compare against the kernel release that contains the fix, which the sources do not name\n- Check whether the OP-TEE driver is in use: `ls /dev/tee0 /dev/teepriv0`\n- unknown for a definitive version list","needs_analyst":true,"not_affected_if":["no-optee-driver"],"who_is_affected":"Systems running a Linux kernel with the OP-TEE driver on hardware that uses OP-TEE as a trusted execution environment, which is typically ARM boards with TrustZone. Systems without OP-TEE hardware or with the driver not loaded are likely not affected, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":3703,"output_tokens":637,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-99024':19A,22A '/dev/tee0':139C '/dev/teepriv0':141C 'add':130C,317C 'alloc':210C 'alreadi':205C 'arg':271C 'argument':263C 'arm':23B 'attack':73B 'beyond':75B 'cach':264C,272C 'call':103C,127C,303C 'call_queue.mutex':233C 'cc':320C 'cdev':128C 'check':195C 'class':150C,153C 'client':110C,180C 'complet':245C 'context':54B,182C,220C 'corrupt':82B 'cq':239C 'crash':14A,79B 'creat':138C 'ctx':275C 'cve':17A,20A 'derefer':291C 'desc':198C 'dev':255C 'devic':7A,41B,96C,105C,114C,125C,129C,146C,155C,164C,191C,209C,301C 'driver':6A,33B 'effect':214C 'find':154C,157C 'fix':295C,318C 'follow':88C 'fulli':99C 'gate':185C,216C 'get':74B,192C 'init':10A,240C,252C,273C 'initi':100C,123C,236C,248C,259C,267C 'intern':45B 'invok':283C 'jw':316C 'kernel':2A,26B,37B,78B,86C,176C 'let':11A 'like':77B 'link':144C 'linux':1A,25B,36B,85C 'linux-kernel':24B 'local':12A 'lock':48B 'memori':81B 'mere':194C 'messag':262C 'moment':161C 'move':298C 'mutex':61B,243C,256C,289C 'node':42B 'non':201C 'non-nul':200C 'null':64B,202C,278C,293C 'op':4A,31B 'op-te':3A,30B 'open':8A,55B,173C,181C,188C,221C,280C 'opte':27B,93C,101C,120C,230C,232C,238C,241C,250C,253C,269C,274C,312C 'point':307C 'pointer':65B,294C 'probe':102C 'reachabl':166C 'regist':38B,94C,106C,126C,302C 'resolv':92C 'rest':117C 'rpmb':254C 'run':226C 'runtim':28B 'session':281C 'set':50B,206C,314C 'shm':270C 'sourc':67B 'space':170C,177C 'state':70B 'still':277C 'struct':119C,229C,311C 'structur':46B 'supp':242C,251C 'supplic':113C 'take':16A,287C 'tee':5A,32B,40B,95C,104C,124C,149C,172C,179C,190C,208C,300C 'teedev':187C,197C 'therefor':211C 'thing':134C 'two':133C 'uniniti':60B,288C 'use':59B 'user':13A,169C 'via':171C,178C 'vulner':89C 'window':58B,224C,286C 'yet':260C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the OP-TEE driver on hardware that uses OP-TEE as a trusted execution environment, which is typically ARM boards with TrustZone. Systems without OP-TEE hardware or with the driver not loaded are likely not affected, though the sources do not state this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99024","severity":null,"published_at":"2026-10-23T13:17:25+00:00","modified_at":"2026-10-23T13:17:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99024","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99024","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}