Samsung mTower CVE-2026-82927

Exploitation requires executing arbitrary code in the Normal World of an ARM Cortex-M TrustZone system running mTower as the TEE. The attacker must be able to invoke the TEE ioctl interface (tee_ioctl_open_session or the invoke-command path) with a crafted tee_ioctl_buf_data containing a buf_ptr or memref buffer pointer that references Secure-attributed memory. No special configuration beyond deploying mTower as the TEE is required - the vulnerable code paths are active in default open-session and invoke flows. Exploitation is concretely limited by: (1) requiring local code execution in Normal World on the target physical device; (2) the target must run mTower specifically rather than another TEE implementation; (3) the choice between the open-session and invoke paths determines which copy_in_params or validate_param_memrefs codepath is triggered. The secondary TOCTOU variant additionally requires the ability to schedule a Non-Secure interrupt handler that fires during the narrow window between Secure world attribution validation and parameter use.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5) materially understates real-world impact and contains metric assignments that conflict with the described vulnerability mechanism. C:N and I:N are inconsistent with an unvalidated pointer dereference across the TrustZone boundary: a Normal World caller supplying a Secure-RAM address as an INPUT buffer causes the Secure world to read Secure RAM (confidentiality breach); supplying it as an OUTPUT or INOUT parameter causes the Secure world to write results back into Secure RAM (integrity breach). Neither outcome is availability-only. S:U (unchanged scope) is also questionable since exploitation directly violates the TrustZone isolation boundary between Normal and Secure worlds. UI:R is unexplained by either the vulnerability description or the PR diff. The 'Information Disclosure' tag in the provided metadata therefore appears more accurate than the CVSS impact ratings - CVSS score should not be used alone to prioritize this issue. No EPSS score is available; no KEV listing exists; no public POC has been identified, preventing quantitative exploitation probability assessment. The deployment footprint of mTower is narrow (research-grade embedded TEE for Cortex-M), limiting mass-exploitation risk, but any device storing secrets in mTower's Secure world should treat this as a high-severity confidentiality and integrity issue rather than a moderate availability issue.

A malicious process executing in the ARM Cortex-M Normal World calls the mTower tee_ioctl_open_session ioctl with a crafted tee_ioctl_buf_data whose buf_ptr field or embedded memref buffer pointer references Secure world RAM rather than Normal World memory. The unpatched Secure world kernel passes this pointer directly into tee_ta_param without SAU/IDAU attribution checks, causing the TA to read from or write to that Secure RAM address, enabling exfiltration of Secure world secrets such as stored cryptographic keys or corruption of Secure world data structures. No public POC has been identified, but the attack primitive is straightforward for a developer familiar with the OP-TEE/mTower ioctl ABI.