CVE-2026-71968

Name of the Vulnerable Software and Affected Versions OP-TEE OS versions prior to 4.10.0 commit 8794043

Description A use-after-free issue exists in the Trusted Application loader. Attackers capable of loading a signed Trusted Application can corrupt secure-world kernel memory by setting the TA FLAG CONCURRENT flag in a user TA signed header. This allows two concurrent sessions to operate on the same shared context without locking, which corrupts the uctx->vm info.regions list during memref parameter mapping and unmapping. Consequently, vm region nodes still in use are freed, leading to a use-after-free in S-EL1 secure-world kernel memory.

Recommendations Update to the version containing commit 8794043.