CVE-2026-71968

Received Received - Intake

Use-After-Free in OP-TEE OS Trusted Application Loader

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TA_FLAG_CONCURRENT flag in a user TA signed header. Attackers can cause two concurrent sessions to operate on the same shared context without locking, corrupting the uctx->vm_info.regions list during memref parameter mapping and unmapping to free vm_region nodes still in use, resulting in a use-after-free in S-EL1 secure-world kernel memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-71968

EUVD

EUVD-2026-55697

Affected Vendors & Products

Vendor	Product	Version / Range
op-tee	op-tee_os	to 4.10.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in OP-TEE OS through version 4.10.0. It occurs in the Trusted Application loader when attackers with the ability to load a signed Trusted Application set the TA_FLAG_CONCURRENT flag in the header. This causes two concurrent sessions to share a context without proper locking, leading to corruption of the uctx->vm_info.regions list during memory operations. The result is a use-after-free in secure-world kernel memory at S-EL1 level.

Detection Guidance

This vulnerability requires checking for OP-TEE OS versions before commit 8794043. Use commands like 'strings /path/to/optee_os | grep -i "TA_FLAG_CONCURRENT"' to inspect TA headers. Monitor secure-world kernel logs for memory corruption errors or use-after-free crashes in S-EL1.

Impact Analysis

If exploited, this vulnerability could allow attackers to corrupt secure-world kernel memory, potentially leading to system crashes, unauthorized access, or privilege escalation in the secure environment. Systems relying on OP-TEE for trusted execution may face compromised security guarantees.

Compliance Impact

This vulnerability allows attackers to corrupt secure-world kernel memory in OP-TEE OS, potentially leading to unauthorized access or data breaches. Such breaches could violate compliance requirements under GDPR (data protection) or HIPAA (healthcare data security) by exposing sensitive information or undermining secure processing environments.

Mitigation Strategies

Update OP-TEE OS to a version that includes commit 8794043 or later to address the use-after-free vulnerability in the Trusted Application loader.

Hi! I’m here to help you understand CVE-2026-71968. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70