PT-2026-122001
CVE-2026-99024
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
optee: register TEE devices only once fully initialized
optee probe() called tee device register() on both the client and the
supplicant device before the rest of struct optee had been initialized.
tee device register() calls cdev device add(), which does two things at
once: it creates /dev/tee0 and /dev/teepriv0, and it links the device
into the tee class so that class find device() can find it. From that
moment on the device is reachable both from user space via tee open()
and from kernel space via tee client open context(). The only gate in
teedev open() is tee device get(), which merely checks that
teedev->desc is non-NULL, which was already set by tee device alloc().
Therefore, there is effectively no gate at all.
A context opened in that window can run against a struct optee where
- optee->call queue.mutex is not initialized by optee cq init()
- optee->supp mutex and completions is not initialized by optee supp init()
- optee->rpmb dev mutex is not initialized yet,
- the message argument cache is not initialized by optee shm arg cache init()
- optee->ctx is still NULL
Any open session or invoke during this window takes uninitialized
mutexes and dereferences a NULL pointer.
Fix it by moving both tee device register() calls down to the point
where all of struct optee is set up.
[JW: adding fixes and cc]
Found an issue in the description? Have something to add? Feel free to write us 👾