CVE-2026-44362: OP-TEE Subkey Rollback Protection Bypass (v3.20.0–4.10.x)

Technical summary

The vulnerability exists in OP-TEE's subkey rollback protection mechanism. Specifically, in `core/crypto/signed_hdr.c`, the function `shdr_load_pub_key()` parses subkey headers from TA signatures but fails to assign the `subkey_version` field from the header to the runtime `shdr_pub_key` structure. This results in `key->version` remaining zeroed. Subsequently, when `ree_fs_ta_open()` in `core/kernel/ree_fs_ta.c` invokes `check_update_version()`, it passes this zero-valued version to the rollback database. Because the database never receives an updated (non-zero) version value, it cannot advance the stored version state, effectively nullifying rollback protection. TAs signed with downgraded subkey chains bypass version verification and load successfully, compromising the TA authentication chain.

Business impact

This vulnerability enables compromise of the Trusted Execution Environment's application integrity guarantees. An attacker with local access could load Trusted Applications signed with revoked or older key material, potentially gaining persistent control over sensitive operations—such as cryptographic key management, DRM, or payment processing—that rely on OP-TEE's security isolation. For organizations deploying OP-TEE on edge devices, IoT gateways, or mobile-adjacent systems, a compromised TEE undermines the entire security model and can lead to data exfiltration, unauthorized transactions, or lateral movement into the non-secure kernel. The integrity impact is severe even though confidentiality is not directly affected.

Affected systems

The vulnerability affects OP-TEE mainline configurations from version 3.20.0 through 4.10.x that utilize subkey-based signing chains for Trusted Application authentication. Systems running vulnerable OP-TEE versions on Arm Cortex-A cores with TrustZone are at risk, particularly those that rely on subkey rollback protection as part of their TA deployment and update workflow. Verify your OP-TEE version and confirm whether subkey-based TA signing is enabled in your configuration.

Exploitability

Exploitation requires local privilege access (CWE-285: Improper Authorization), as indicated by the CVSS vector. An attacker must have the ability to control which TA is loaded onto the device, either through physical access, a compromised bootloader, or privilege escalation within the non-secure Linux kernel. However, once local privilege is achieved, exploitation is straightforward: craft or obtain a TA signed with a revoked subkey version, and the system will load it without verification. There is no known public exploit code, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, suggesting limited active weaponization to date.

Remediation

Upgrade OP-TEE to version 4.11.0 or later, which fixes the subkey version assignment in `shdr_load_pub_key()`. Organizations unable to upgrade immediately should verify that their TA signing infrastructure enforces additional controls: maintain strict access restrictions on subkeys, implement robust key lifecycle management external to OP-TEE's rollback database, and conduct audits of all TAs currently deployed to identify any signed with revoked material. No known workarounds are available within OP-TEE itself.

Patch guidance

Apply OP-TEE version 4.11.0 or newer. The patch restores version propagation during TA key loading. Before updating, test in a staging environment to confirm compatibility with your deployed TAs and kernel version. Review the official OP-TEE release notes and commit history for any other changes in the 4.11.0 release that may affect your system. Post-patch, re-validate your TA loading workflow to confirm that rollback protection is functioning as expected.

Detection guidance

Monitor OP-TEE version numbers across your infrastructure; systems reporting versions 3.20.0–4.10.x are vulnerable. If you maintain audit logs or debug output from OP-TEE TA loading, look for TAs being successfully loaded with suspiciously old or revoked subkey versions—though in practice, such logs may be sparse in production. Implement runtime checks: if possible, log all TA load events with their signing key metadata and periodically validate that no TAs are present that were signed with revoked subkey material. Use static analysis or binary inspection tools to scan deployed TAs against your current key revocation list.

Why prioritize this

Although the CVSS score is 5.5 (Medium), this vulnerability merits higher-priority treatment in environments where OP-TEE secures sensitive operations. The integrity impact is direct and high, the attack surface is local but persistent (any application or process with sufficient privilege can exploit it), and the fix is available and relatively low-risk. Prioritize patching for devices supporting payment, DRM, or cryptographic key management; defer less critical deployments only if rigorous compensating controls are in place.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack requiring privilege escalation (PR:L), no user interaction (UI:N), and a high integrity impact (I:H) with no confidentiality or availability concern. The score appropriately captures the need for local access but may underweight the criticality of TEE integrity in many real-world deployments. Organizations should raise their internal risk priority if OP-TEE manages high-value secrets or controls security-sensitive hardware.

Frequently asked questions