CVE-2026-45702

OP-TEE has FF-A type confusion in SPMC tmem path that causes S-EL1 kernel panic

State: Published
Severity: 4.4 Medium
Published: Jun 3, 2026
Updated: Jun 4, 2026
Reserved: May 13, 2026

Description

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.3.0 and prior to version 4.11.0, a type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_CORE_SEL1_SPMC=y` and `CFG_SECURE_PARTITION=y`. Version 4.11.0 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Affected Products

Product	Versions
optee_osOP-TEE	>= 4.3.0, < 4.11.0Affected

References

https://github.com/OP-TEE/optee_os/security/advisories/GHSA-86pj-8xgw-66p5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.