CVE-2026-40290
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In OP-TEE versions 3.16.0 through 4.10.0, a use-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A SPMC/SP flows, where a thread calling sp_mem_remove() without a lock can free objects while another thread dereferences them.
Risk Assessment
An attacker could cause a system crash or potentially execute arbitrary code in the context of the Trusted Execution Environment (TEE), compromising isolation security.
Recommendation
Update OP-TEE to version 4.11.0 or later, which contains the fix.
Other vulnerabilities in OP-TEE
See all- CVE-2026-53763Low
A 32-bit integer overflow vulnerability exists in the AES-GCM implementation of the OP-TEE core. After processing more than 512 megabytes of payload or Additional Authenticated Data (AAD), the authentication tag is computed with incorrect bit-length values.
- CVE-2026-44362Medium
In OP-TEE from version 3.20.0 to 4.10.0, a vulnerability exists in the subkey rollback protection mechanism. The `shdr_load_pub_key()` function fails to assign the subkey version to the runtime structure, leaving the version field at zero. Consequently, the version update check (`check_update_version()`) does not record the correct version, allowing Trusted Applications (TAs) signed with older or revoked subkeys to load successfully.
- CVE-2026-42546Low
In OP-TEE from version 3.3.0 to 4.10.0, a resource leak exists in the `cleanup_shm_refs()` function due to missing bitmask application on parameter attributes. This skips the `mobj_put()` call for non-contiguous memory parameters, causing a persistent leak of `mobj_reg_shm` objects and exhaustion of the secure-world heap.
- CVE-2026-41516Low
The RSA PKCS#1 v1.5 implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a Bleichenbacher-style attack. Non-constant-time `memcmp()` and distinguishable error paths allow an attacker to recover plaintext.
- CVE-2026-41515Low
The RSA-OAEP decryption in the NXP CAAM crypto driver for OP-TEE (versions 3.9.0 to 4.10.0) uses non-constant-time `memcmp()` for label hash verification and has distinguishable error paths. This allows an attacker to recover RSA-OAEP plaintext with approximately 1000-2000 adaptive chosen ciphertext queries via a Manger-style padding oracle.
- CVE-2026-41514Low
The RSA-OAEP implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a padding oracle attack. Non-constant-time memcmp() for label hash verification and distinguishable error paths allow plaintext recovery with approximately 1000-2000 adaptive chosen ciphertext queries.
- CVE-2026-41434Low
In OP-TEE from version 3.10.0 to 4.10.0, an unbounded recursion vulnerability in the PKCS#11 TA can cause a system crash. The issue is fixed in version 4.11.0.
- CVE-2026-40257Medium
An off-by-one error in the ARM Crypto Extensions accelerated SHA-3 implementation in OP-TEE can cause a massive heap overflow, corrupting all TEE kernel memory after the hash state. Affected versions are from 3.21.0 to 4.11.0 with `CFG_CRYPTO_WITH_CE82=y`.
- CVE-2026-45702Medium
A type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world, affecting versions 4.3.0 through 4.11.0. This only applies when configured as an SPMC for S-EL0 SPs.
- CVE-2026-45614Medium
OP-TEE before version 4.11.0 does not verify that an ECDH public key lies on the correct curve. An attacker in the normal world can send about 30-40 crafted public keys to reconstruct the private key.
Original NVD description (English source)
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.16.0 and prior to 4.11.0, a user-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A within OP-TEE SPMC/SP flows. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_SECURE_PARTITION=y`. The function `sp_mem_remove()`, responsible for freeing entries in `smem->receivers` and `smem->regions`, fails to acquire the global `sp_mem_lock` before performing the `free()` operations. Concurrently, other code paths, such as `sp_mem_get_receiver()`, iterate over these same lists without holding a lock, or, like `sp_mem_is_shared()`, iterate while holding the lock but are not serialized against the unprotected `free()` in `sp_mem_remove()`. This creates a cross-thread race where a thread iterating the list can acquire a pointer to an entry (e.g., `struct sp_mem_map_region` or `struct sp_mem_receiver`), and then another thread calls `sp_mem_remove()`, freeing the object. When the first thread resumes and dereferences the pointer, it results in a Use-After-Free vulnerability. Version 4.11.0 fixes the issue.