CVE-2026-99024

In the Linux kernel, the following vulnerability has been resolved:

optee: register TEE devices only once fully initialized

optee probe() called tee device register() on both the client and the supplicant device before the rest of struct optee had been initialized.

tee device register() calls cdev device add(), which does two things at once: it creates /dev/tee0 and /dev/teepriv0, and it links the device into the tee class so that class find device() can find it. From that moment on the device is reachable both from user space via tee open() and from kernel space via tee client open context(). The only gate in teedev open() is tee device get(), which merely checks that teedev->desc is non-NULL, which was already set by tee device alloc(). Therefore, there is effectively no gate at all.

A context opened in that window can run against a struct optee where

Any open session or invoke during this window takes uninitialized mutexes and dereferences a NULL pointer.

Fix it by moving both tee device register() calls down to the point where all of struct optee is set up.

[JW: adding fixes and cc]