mTower CVE-2026-82926

The attacker must have local access to a system running mTower as its TEE implementation and must be able to reach the TEE ioctl interface - specifically the device node that exposes TEEC_InvokeCommand. The triggering condition is simply supplying an invalid, zero, or stale session ID in a TEEC_InvokeCommand call; no valid pre-existing session is required. Exploitation is bounded by the local attack vector (AV:L) - remote exploitation is not possible. The crash affects only the secure-world TEE process, not the normal-world OS kernel, limiting blast radius to TEE-dependent services. The vendor's PR:N assertion implies the TEE device node may be world-accessible on some configurations, but device node permissions are OS and distribution-specific; defenders should audit device node ACLs as a first step.

The vendor-supplied CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a local denial-of-service with no confidentiality or integrity exposure. Two metric assignments warrant scrutiny: PR:N is questionable because invoking TEE ioctls typically requires at least user-level access to a TEE device node, making PR:L more technically accurate; UI:R is unexplained - the patch comments describe a Non-Secure caller sending a malformed ioctl without any described user interaction requirement, and no rationale for UI:R is evident. No EPSS score is present in available intelligence, no CISA KEV listing exists, and no POC exploit has been identified. Practical impact is limited to crashing the secure world, which could disrupt TEE-backed security services (key storage, secure boot attestation) on affected devices but does not enable code execution or data exfiltration. This is a moderate operational concern for embedded or IoT deployments running mTower, but a low organizational priority given the local-only attack vector, niche product footprint, and complete absence of known exploitation activity.

A local process with access to the TEE device node sends a TEEC_InvokeCommand ioctl carrying an invalid or zeroed session ID. The TEE kernel's find_session() returns NULL, and without the NULL guard, the subsequent dereference of sess->ctx triggers a fault in the secure world, crashing the TEE and denying service to all applications relying on TEE-backed operations. No public exploit code has been identified at time of analysis.