GHSA-QP8F-JJVM-547W
Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-23 15:31In the Linux kernel, the following vulnerability has been resolved:
optee: register TEE devices only once fully initialized
optee_probe() called tee_device_register() on both the client and the supplicant device before the rest of struct optee had been initialized.
tee_device_register() calls cdev_device_add(), which does two things at once: it creates /dev/tee0 and /dev/teepriv0, and it links the device into the tee class so that class_find_device() can find it. From that moment on the device is reachable both from user space via tee_open() and from kernel space via tee_client_open_context(). The only gate in teedev_open() is tee_device_get(), which merely checks that teedev->desc is non-NULL, which was already set by tee_device_alloc(). Therefore, there is effectively no gate at all.
A context opened in that window can run against a struct optee where
- optee->call_queue.mutex is not initialized by optee_cq_init()
- optee->supp mutex and completions is not initialized by optee_supp_init()
- optee->rpmb_dev_mutex is not initialized yet,
- the message argument cache is not initialized by optee_shm_arg_cache_init()
- optee->ctx is still NULL
Any open session or invoke during this window takes uninitialized mutexes and dereferences a NULL pointer.
Fix it by moving both tee_device_register() calls down to the point where all of struct optee is set up.
[JW: adding fixes and cc]
{
"affected": [],
"aliases": [
"CVE-2026-99024"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-23T13:17:25Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\noptee: register TEE devices only once fully initialized\n\noptee_probe() called tee_device_register() on both the client and the\nsupplicant device before the rest of struct optee had been initialized.\n\ntee_device_register() calls cdev_device_add(), which does two things at\nonce: it creates /dev/tee0 and /dev/teepriv0, and it links the device\ninto the tee class so that class_find_device() can find it. From that\nmoment on the device is reachable both from user space via tee_open()\nand from kernel space via tee_client_open_context(). The only gate in\nteedev_open() is tee_device_get(), which merely checks that\nteedev-\u003edesc is non-NULL, which was already set by tee_device_alloc().\nTherefore, there is effectively no gate at all.\n\nA context opened in that window can run against a struct optee where\n\n - optee-\u003ecall_queue.mutex is not initialized by optee_cq_init()\n - optee-\u003esupp mutex and completions is not initialized by\n optee_supp_init()\n - optee-\u003erpmb_dev_mutex is not initialized yet,\n - the message argument cache is not initialized by\n optee_shm_arg_cache_init()\n - optee-\u003ectx is still NULL\n\nAny open session or invoke during this window takes uninitialized\nmutexes and dereferences a NULL pointer.\n\nFix it by moving both tee_device_register() calls down to the point\nwhere all of struct optee is set up.\n\n[JW: adding fixes and cc]",
"id": "GHSA-qp8f-jjvm-547w",
"modified": "2026-10-23T15:31:35Z",
"published": "2026-10-23T15:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99024"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/262062c01f5a817104c88bf6eacb7c6ffdc7018d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2f7240f0a6fd83df274fc0a2abf0609b4e6bd388"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/681adbc9c7a820279582a295e183fa6a1d1b4ec4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8cae1605be8a047ae3a62df07b9474d61462c4f6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c108feca0a096f8db25d1b69130035025e9e936d"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.