SB20261023135 - Use of uninitialized resource in Linux kernel tee optee driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-99024)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering invalid kernel memory access during OP-TEE device initialization.

The vulnerability exists due to use of uninitialized resources in the Linux kernel OP-TEE driver when TEE devices become accessible before initialization of the associated driver state is complete. A local user can open an accessible TEE device and initiate a session or invoke an operation during this initialization window to trigger use of uninitialized mutexes and a NULL pointer dereference, potentially crashing the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/262062c01f5a817104c88bf6eacb7c6ffdc7018d
• https://git.kernel.org/stable/c/2f7240f0a6fd83df274fc0a2abf0609b4e6bd388
• https://git.kernel.org/stable/c/681adbc9c7a820279582a295e183fa6a1d1b4ec4
• https://git.kernel.org/stable/c/8cae1605be8a047ae3a62df07b9474d61462c4f6
• https://git.kernel.org/stable/c/c108feca0a096f8db25d1b69130035025e9e936d