OP-TEE CVE-2026-42546

Exploitation requires local, low-privileged access to the normal world (Linux user space) on a device running OP-TEE in a non-FF-A configuration with non-contiguous, non-secure shared memory support enabled. The attacker must be able to invoke TEE operations and supply parameters that exercise the non-contiguous memory path - this is a standard TEE API interaction, not an obscure or privileged operation, but it does require the specific configuration (non-FF-A + non-contiguous shared memory). Devices using FF-A configurations are explicitly excluded. The impact is slow and cumulative rather than immediate: a single trigger causes a small leak; sustained triggering over time leads to heap exhaustion. Limiting factors include the need for local access (AV:L), the requirement for non-default or platform-specific non-contiguous memory configuration, and the gradual nature of the DoS - detection and reboot can interrupt an attack before full heap exhaustion is reached.

The NVD CVSS base score of 3.8 (Low) and the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L reflect a locally-triggered, low-complexity availability issue with a scope change into the secure world (S:C), but the impact on that scope is rated Low (A:L). This scoring is broadly appropriate: exploitation requires local, low-privileged normal-world access to invoke TEE operations, and the availability impact is gradual degradation rather than instant crash. The scope change to the secure world is notable - normal-world code should not be able to destabilize the TEE - but the attack only causes DoS and not confidentiality or integrity compromise. No EPSS score was provided in the input, so probabilistic exploitation frequency cannot be quantified. The flaw is NOT in the CISA KEV catalog and no POC is known; real-world exploitation risk is therefore assessed as low-to-moderate for targeted embedded or mobile platform attacks where an adversary already has normal-world local access. The primary real-world threat vector is a malicious or compromised application on an Arm TrustZone device repeatedly invoking TEE operations with non-contiguous shared memory to degrade or crash trusted application services. For devices where OP-TEE hosts security-critical trusted applications (e.g., key storage, DRM, secure authentication), a TEE DoS has outsized operational impact beyond the raw CVSS score suggests.

An unprivileged process on a Linux system running OP-TEE 3.3.0-4.10.x with non-FF-A and non-contiguous shared memory support repeatedly opens TEE sessions and passes non-contiguous memory parameters, causing cleanup_shm_refs() to skip mobj_put() on each invocation. Over thousands of calls, mobj_reg_shm objects accumulate on internal lists, progressively exhausting the secure-world heap until new trusted application operations - such as key storage reads, DRM license checks, or biometric authentication - begin failing, ultimately requiring a full device reboot to restore TEE functionality. No public POC exists at time of analysis, but the attack is mechanically straightforward for any caller with TEE access rights.