CVE-2026-0428

LowCVSS 1.8

Published: 15/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

Insufficient parameter sanitization in the TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS command to write invalid data to a remote Die, potentially resulting in unexpected behavior.

Risk Assessment

An attacker may cause undefined behavior or instability in the TEE/SOC environment by writing invalid data to a remote Die. This may affect the integrity and availability of TEE-based services.

Recommendation

Apply available TEE SOC driver updates from the vendor. Restrict the ability to invoke DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS to trusted components.

Other vulnerabilities in TEE SOC Driver

CVE-2025-0034Medium
Insufficient parameter sanitization in the TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write past the end of allocated arrays, potentially resulting in loss of platform integrity or denial of service.

Original NVD description (English source)

Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS to write invalid data to a remote Die, potentially resulting in unexpected behavior.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS