EUVD-2026-41911Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local access with low privilege needed to reach the TA loader; integrity-only impact (rollback bypass); scope unchanged as compromise stays within the TEE loading subsystem.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20.0 and prior to version 4.11.0, a vulnerability in OP-TEE’s subkey rollback protection allows the use of revoked or older subkey versions because the system fails to propagate versioning data during the Trusted Application (TA) loading process. In core/crypto/signed_hdr.c, the function shdr_load_pub_key() parses subkey headers but does not assign the subkey_version to the runtime shdr_pub_key structure. As a result, the key->version field remains at zero regardless of the version specified in the header. When ree_fs_ta_open() in core/kernel/ree_fs_ta.c calls check_update_version(), it passes this zeroed version to the rollback database. Because the database never receives a non-zero version to record, it never advances, effectively bypassing the rollback check and allowing TAs signed with downgraded subkey chains to load successfully. This impacts OP-TEE mainline configurations that utilize subkey-based signing chains for Trusted Application (TA) authentication. Version 4.11.0 contains a patch. No known workarounds are available.
AnalysisAI
Subkey rollback protection in OP-TEE OS versions 3.20.0 through 4.10.x is completely non-functional due to a missing field assignment in the Trusted Application loading pipeline, allowing revoked or downgraded subkeys to authenticate TAs without detection. A locally authenticated attacker who can supply TA binaries to the REE filesystem loader can bypass the entire key-chain revocation model, loading previously invalidated trusted code into the TrustZone secure world. No public exploit has been identified at time of analysis and this is not listed in CISA KEV, but the integrity impact is categorical - the rollback database never advances, permanently defeating the control for any deployment relying on subkey-based TA signing chains.
Technical ContextAI
OP-TEE is an open-source Trusted Execution Environment (TEE) running in ARM TrustZone Cortex-A secure world, providing isolated execution for sensitive Trusted Applications (TAs). The vulnerability originates in core/crypto/signed_hdr.c within shdr_load_pub_key(), which correctly parses the subkey_version field from TA subkey headers but never assigns that parsed value to the runtime shdr_pub_key structure. Consequently, key->version is always zero at the point ree_fs_ta_open() in core/kernel/ree_fs_ta.c calls check_update_version(), which passes this zero to the rollback database. A zero version never causes the rollback database to advance, rendering the anti-rollback check a no-op for any TA authenticated through a subkey chain. The root cause class is CWE-285 (Improper Authorization) - specifically a logic gap where a security-relevant attribute is parsed but silently discarded before the authorization decision. Affected CPE: cpe:2.3:a:op-tee:optee_os:*:*:*:*:*:*:*:* covering versions 3.20.0 through 4.10.x.
RemediationAI
Upgrade to OP-TEE OS version 4.11.0, which contains the vendor-confirmed patch correcting shdr_load_pub_key() to properly assign subkey_version to the runtime shdr_pub_key structure before check_update_version() is invoked. The fix is documented in the vendor security advisory at https://github.com/OP-TEE/optee_os/security/advisories/GHSA-fhcg-pp56-8v75. The vendor has explicitly stated that no known workarounds are available. For environments where an immediate upgrade is operationally infeasible, consider restricting which processes or users can invoke the REE filesystem TA loader interface to reduce the pool of potential abusers - note that this is an access-control compensating control around the symptom, not a fix for the underlying rollback database failure, and may disrupt legitimate TA deployment workflows. Any such restriction should be treated as temporary pending the 4.11.0 upgrade.
Out-of-bounds read and write in OP-TEE OS PKCS#11 Trusted Application (versions 3.13.0-4.10.0) allows authenticated loca
Secure-world heap corruption in OP-TEE OS through 4.10.0 allows a malicious Trusted Application to write attacker-contro
Use-after-free in the OP-TEE OS Trusted Application loader (all versions through 4.10.0) allows an attacker who controls
Use-after-free race condition in OP-TEE OS versions 3.16.0 through 4.10.x enables local low-privileged attackers to corr
Integer overflow in OP-TEE OS RSA signature encoding crashes the Trusted Execution Environment on platforms with RSA har
Null pointer dereference in OP-TEE OS through version 4.10.0 allows a low-privileged Normal World process to crash the e
Heap overflow in OP-TEE's ARM Crypto Extensions SHA-3 implementation corrupts TEE kernel memory across all platforms bui
Type confusion in OP-TEE OS versions 4.3.0 through 4.10.x allows a highly privileged local attacker operating in the nor
Private ECDH key recovery in OP-TEE prior to version 4.11.0 is achievable by a local attacker who can invoke TEE_DeriveK
Integer overflow in OP-TEE OS's AES-GCM implementation silently corrupts authentication tag computation when a single op
Heap exhaustion in OP-TEE OS (versions 3.3.0 through 4.10.x) allows a low-privileged normal-world local caller to progre
Stack exhaustion via unbounded recursion in the OP-TEE PKCS#11 Trusted Application allows a local low-privileged user to
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today