CVE-2026-42546: OP-TEE Shared Memory Resource Leak (CVSS 3.8)

Technical summary

CVE-2026-42546 is a resource leak in OP-TEE versions 3.3.0 through 4.10.x stemming from inadequate bitmask application in the cleanup_shm_refs() function within core/tee/entry_std.c. The function fails to apply OPTEE_MSG_ATTR_TYPE_MASK when evaluating parameter attributes during normal-world shared memory cleanup. This causes the switch statement to fail matching non-contiguous memory parameter types, bypassing the mobj_put() dereferencing call. The resulting mobj_reg_shm objects remain on internal lists with unbalanced reference counts, progressively consuming secure-world heap space. The vulnerability is confined to non-FF-A deployments that expose non-contiguous, non-secure shared memory interfaces.

Business impact

This vulnerability degrades TEE availability and trustworthy application performance over time. Organizations relying on OP-TEE for cryptographic operations, secure key storage, or DRM enforcement will experience latency increases and eventual service unavailability as heap exhaustion prevents new trusted application operations. Repeated system reboots become necessary to reset memory state. The impact is particularly acute for always-on embedded systems, IoT devices, and mobile platforms where continuous TEE operation is expected. However, the localized nature and low exploitability limit the risk profile for most enterprise deployments.

Affected systems

The vulnerability affects OP-TEE versions 3.3.0 through 4.10.x running on Arm Cortex-A cores with TrustZone support. Only systems using non-FF-A (non-Firmware Framework for Arm A-profile) configurations that permit non-contiguous shared memory parameters are impacted. FF-A-compliant deployments are unaffected. This includes certain embedded Linux systems, IoT platforms, and mobile devices where OP-TEE provides the trusted execution environment, particularly those built on older or customized firmware stacks.

Exploitability

Exploitation requires local access to the system and the ability to invoke OP-TEE shared memory operations repeatedly. The vulnerability is not remotely exploitable. No elevated privileges are strictly necessary—an unprivileged process can trigger the leak by making successive system calls that exercise the non-contiguous memory cleanup path. However, practical exploitation is passive: an attacker repeatedly calls the vulnerable code path until heap exhaustion occurs. There are no known public exploits, and the CVE is not tracked on CISA's KEV catalog.

Remediation

Upgrade OP-TEE to version 4.11.0 or later, which applies a bitmask correction to the cleanup_shm_refs() function to properly evaluate parameter attributes. Organizations should test patches in a staging environment first, particularly because OP-TEE is deeply integrated into firmware stacks and bootloaders. If immediate patching is infeasible, consider restricting non-contiguous shared memory access or deploying FF-A-compliant firmware configurations, though these may require hardware or significant architectural changes.

Patch guidance

Apply OP-TEE version 4.11.0 or any subsequent release. Verify patch deployment by confirming the version string in OP-TEE logs or via firmware diagnostics. Because OP-TEE typically resides in read-only firmware or secure bootloaders, patching often requires coordinated updates with board-level support packages, kernel drivers, or OEM firmware distributions. Test the update on non-production systems first to ensure no regressions in trusted application compatibility. Consult your device manufacturer or OP-TEE distribution channel for signed, validated builds.

Detection guidance

Monitor for signs of secure-world heap exhaustion: increasing latency in trusted application calls, intermittent timeouts from cryptographic or DRM operations, and system reboots attributed to TEE faults. Enable TEE debug logging if available to detect mobj_reg_shm reference count anomalies or allocation failures. Correlate TEE errors with patterns of repeated non-contiguous shared memory parameter usage. Memory profiling tools specific to your TEE implementation may expose persistent mobj references. Detection is difficult without invasive instrumentation, so focus on proactive patching rather than reactive detection.

Why prioritize this

Although CVSS 3.8 reflects low severity, the vulnerability merits prompt but measured attention because it affects system stability and long-term TEE availability. It is not an acute security breach risk but rather a reliability and availability concern. Organizations with strict uptime requirements or those operating safety-critical systems should prioritize patching earlier. Others can integrate the fix into routine firmware maintenance cycles. The absence of remote exploitability and active exploitation lowers urgency compared to critical vulnerabilities.

Risk score, explained

CVSS 3.1 score of 3.8 (LOW) reflects the attack vector (local only, AV:L), low complexity (AC:L), requirement for local privilege or user context (PR:L), absence of user interaction (UI:N), and scope change that impacts only availability (C:N, I:N, A:L). The score appropriately captures that this is a denial-of-service vector through resource exhaustion rather than a confidentiality or integrity threat. The main risk is operational continuity rather than data breach or system compromise.

Frequently asked questions