Title: optee_os de OP-TEE, Description: OP-TEE es un Entorno de Ejecución Confiable (TEE) diseñado como compañero de un kernel de Linux no seguro que se ejecuta en núcleos Arm; Cortex-A utilizando la tecnología TrustZone. A partir de la versión 3.16.0 y antes de la 4.11.0, existe una condición de carrera de uso después de liberación (UAF) en la lógica de desmantelamiento de memoria compartida de FF-A dentro de los flujos SPMC/SP de OP-TEE. Esto solo aplica cuando OP-TEE está configurado como un SPMC para SPs S-EL0, es decir, con 'CFG_SECURE_PARTITION=y'. La función 'sp_mem_remove()', responsable de liberar entradas en 'smem->receivers' y 'smem->regions', no logra adquirir el 'sp_mem_lock' global antes de realizar las operaciones de 'free()'. Concurrentemente, otras rutas de código, como 'sp_mem_get_receiver()', iteran sobre estas mismas listas sin mantener un bloqueo, o, como 'sp_mem_is_shared()', iteran mientras mantienen el bloqueo pero no están serializadas contra el 'free()' desprotegido en 'sp_mem_remove()'. Esto crea una condición de carrera entre hilos donde un hilo que itera la lista puede adquirir un puntero a una entrada (p. ej., 'struct sp_mem_map_region' o 'struct sp_mem_receiver'), y luego otro hilo llama a 'sp_mem_remove()', liberando el objeto. Cuando el primer hilo se reanuda y desreferencia el puntero, resulta en una vulnerabilidad de uso después de liberación. La versión 4.11.0 corrige el problema.

{"timestamp":"2026-06-04T14:17:15.528743Z","id":"CVE-2026-40290","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"OP-TEE","product":"optee_os","versions":[{"version":">= 3.16.0, < 4.11.0","status":"affected"}]}]

OR
          *cpe:2.3:o:linaro:op-tee:*:*:*:*:*:*:*:* versions from (including) 3.16.0 up to (including) 4.10.0

OR
          *cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:* versions from (including) 3.16.0 up to (including) 4.10.0

OR
          *cpe:2.3:o:linaro:op-tee:*:*:*:*:*:*:*:* versions from (including) 3.16.0 up to (including) 4.10.0

CISA-ADP: https://github.com/OP-TEE/optee_os/security/advisories/GHSA-332c-xr93-849m Types: Exploit, Mitigation, Vendor Advisory

GitHub, Inc.: https://github.com/OP-TEE/optee_os/security/advisories/GHSA-332c-xr93-849m Types: Exploit, Mitigation, Vendor Advisory

https://github.com/OP-TEE/optee_os/security/advisories/GHSA-332c-xr93-849m

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.16.0 and prior to 4.11.0, a user-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A  within OP-TEE SPMC/SP flows. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_SECURE_PARTITION=y`. The function `sp_mem_remove()`, responsible for freeing entries in `smem->receivers` and `smem->regions`, fails to acquire the global `sp_mem_lock` before performing the `free()` operations. Concurrently, other code paths, such as `sp_mem_get_receiver()`, iterate over these same lists without holding a lock, or, like `sp_mem_is_shared()`, iterate while holding the lock but are not serialized against the unprotected `free()` in `sp_mem_remove()`. This creates a cross-thread race where a thread iterating the list can acquire a pointer to an entry (e.g., `struct sp_mem_map_region` or `struct sp_mem_receiver`), and then another thread calls `sp_mem_remove()`, freeing the object. When the first thread resumes and dereferences the pointer, it results in a Use-After-Free vulnerability. Version 4.11.0 fixes the issue.

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416

https://github.com/OP-TEE/optee_os/security/advisories/GHSA-332c-xr93-849m