CVE-2026-44362

Name of the Vulnerable Software and Affected Versions OP-TEE versions 3.20.0 through 4.10.x

Description OP-TEE is a Trusted Execution Environment (TEE) designed as a companion to a non-secure Linux kernel running on Arm Cortex-A cores using TrustZone technology. A flaw in the subkey rollback protection allows the use of revoked or older subkey versions because versioning data is not propagated during the Trusted Application (TA) loading process. Specifically, the function shdr load pub key() in core/crypto/signed hdr.c parses subkey headers but fails to assign the subkey version to the runtime shdr pub key structure, leaving the key->version field at zero. Consequently, when ree fs ta open() in core/kernel/ree fs ta.c calls check update version(), a zeroed version is passed to the rollback database. This prevents the database from advancing and bypasses the rollback check, enabling TAs signed with downgraded subkey chains to load successfully. This issue affects mainline configurations using subkey-based signing chains for TA authentication.

Recommendations Update to version 4.11.0.