CVE-2026-41434: OP-TEE PKCS#11 Unbounded Recursion Denial of Service

Technical summary

An unbounded recursion vulnerability exists in the PKCS#11 Trusted Application (TA) within OP-TEE versions 3.10.0 to prior to 4.11.0. The defect allows a local, low-privileged user to invoke a code path that triggers recursive function calls without proper depth checking or termination conditions, exhausting stack resources and causing a denial of service. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow), though the mechanism is recursion rather than traditional buffer overflow. OP-TEE is the reference implementation of a Trusted Execution Environment for Arm TrustZone, often integrated into mobile and embedded Linux systems.

Business impact

The vulnerability primarily affects availability. A local user can crash the PKCS#11 trusted application, disrupting cryptographic operations, certificate handling, and key management services that depend on this component. For devices relying on OP-TEE for secure boot, payment, or authentication workflows, temporary unavailability of PKCS#11 could interrupt critical user-facing features or backend services. The attack requires local access, limiting exposure to compromised devices or trusted insiders, but the impact compounds in multi-tenant or service-provider scenarios.

Affected systems

Systems running Trusted Firmware OP-TEE versions 3.10.0 through 4.10.x on Arm-based platforms are affected. This includes certain mobile devices, IoT appliances, automotive systems, and embedded Linux boards that build with OP-TEE as their TEE. Version 4.11.0 and later are not vulnerable. Organizations should audit their supply chain and firmware manifests to identify which OP-TEE versions are deployed in their hardware estate.

Exploitability

Exploitation requires local code execution with user-level privileges on the non-secure operating system side—a relatively accessible attack surface on devices without strict execution isolation. However, the attack is straightforward and does not require specialized knowledge, timing precision, or information disclosure; an attacker need only send a crafted request to the PKCS#11 TA. No known public exploits or KEV listing exists, reducing immediate threat pressure, but the low barrier to entry means that once an attacker gains local access, triggering this crash is trivial. The lack of workarounds means patching is the only mitigation.

Remediation

Upgrade OP-TEE to version 4.11.0 or later. Verify the updated version in your firmware build; consult your device manufacturer or OP-TEE distributor for availability and rollout timelines. If immediate upgrade is not possible, restrict local user access and monitor TEE crash logs for signs of exploitation. No configuration changes or library-level workarounds are available.

Patch guidance

Update to OP-TEE 4.11.0 or later. Patch availability depends on your distribution channel—SoC vendors, device manufacturers, and Linux distributions may maintain their own release schedules. Verify the patch version in official changelogs and rebuild your secure firmware image if you maintain a custom OP-TEE integration. Test the patched version in a staging environment to ensure compatibility with cryptographic clients and boot flows before production rollout.

Detection guidance

Monitor system logs and TEE diagnostic buffers for unexpected crashes of the PKCS#11 trusted application. Correlate kernel panic logs or TEE abort messages with local user activity to identify exploitation attempts. If your platform exposes OP-TEE crash diagnostics or memory dumps, analyze call stacks for recursive patterns in PKCS#11 code paths. Implement endpoint detection and response (EDR) or kernel audit rules to flag repeated local process interactions with the TEE interface, as repeated exploitation attempts may leave forensic traces.

Why prioritize this

While the CVSS score is low (3.3) due to local-only access and denial-of-service impact, the practical priority depends on your device fleet and threat model. Prioritize patching if your organization deploys OP-TEE in high-availability environments (e.g., payment terminals, automotive infotainment, or critical IoT) where service disruption carries business cost. For general consumer or development devices, defer to the next planned firmware update cycle. The absence of KEV status and public exploits suggests this is not yet an active threat, but do not delay indefinitely.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects a LOW severity rating due to three factors: (1) Attack Vector is Local, limiting exposure to authenticated or physically present attackers; (2) the sole impact is Availability, with no confidentiality or integrity compromise; (3) no privileges escalation or special conditions are required beyond baseline user-level access. However, CVSS does not account for business context—if your systems are high-value or high-availability targets, internal risk scoring should be higher. The absence of networking capability and the requirement for prior local access are the key mitigating factors.

Frequently asked questions