CVE-2026-42546 Overview
CVE-2026-42546 is a resource leak vulnerability in OP-TEE, a Trusted Execution Environment (TEE) that acts as a companion to a non-secure Linux kernel on Arm Cortex-A cores using TrustZone. The flaw resides in the cleanup_shm_refs() function within core/tee/entry_std.c, where the code fails to apply the required OPTEE_MSG_ATTR_TYPE_MASK bitmask to parameter attributes. When the normal world passes non-contiguous memory parameters, the internal switch statement fails to match the attribute type and skips the required mobj_put() call. This produces persistent reference leaks of mobj_reg_shm objects, which gradually exhaust the secure-world heap. The issue affects OP-TEE versions from 3.3.0 up to but not including 4.11.0 in non-FF-A configurations.
Critical Impact
Progressive secure-world heap exhaustion degrades trusted application services and eventually requires a system reboot to recover.
Affected Products
- TrustedFirmware OP-TEE versions 3.3.0 through 4.10.x
- Non-FF-A configurations supporting non-contiguous, non-secure shared memory
- Arm Cortex-A systems using TrustZone with vulnerable OP-TEE builds
Discovery Timeline
- 2026-07-06 - CVE-2026-42546 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-42546
Vulnerability Analysis
The defect is classified as an uncontrolled resource consumption issue [CWE-770]. OP-TEE's standard entry path receives parameters from the normal world describing shared memory buffers. Each non-contiguous memory reference is tracked internally by an mobj_reg_shm object that holds a reference count.
When a request completes, cleanup_shm_refs() in core/tee/entry_std.c walks the parameter list and is expected to release each reference through mobj_put(). The function inspects the parameter attribute value directly instead of first masking it with OPTEE_MSG_ATTR_TYPE_MASK. Because parameter attributes carry additional flag bits alongside the type field, the raw value fails to match any case in the switch statement covering non-contiguous shared memory types. The cleanup path silently falls through without calling mobj_put().
Each affected invocation leaks one mobj_reg_shm object with a dangling refcount on internal lists. Repeated trusted application calls compound the leak until the secure-world heap is depleted.
Root Cause
The root cause is a missing bitmask operation. The switch statement compares against symbolic type constants, but the input value includes non-type bits that must be stripped with OPTEE_MSG_ATTR_TYPE_MASK before comparison. The absence of that mask causes non-contiguous memory parameter types to be misidentified and skipped during cleanup.
Attack Vector
Exploitation requires local access with the ability to issue trusted application calls from the normal world. An attacker with low privileges can repeatedly invoke operations that pass non-contiguous shared memory parameters. Each call leaks memory in the secure world, and no user interaction is required. Over time, the secure world becomes unable to service new trusted application requests, forcing a reboot. The scope is changed because the leak in the secure world affects the availability of components outside the invoking security domain.
No public proof-of-concept or exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-42546
Indicators of Compromise
- Progressive increase in secure-world heap usage without corresponding release events during normal trusted application activity.
- Trusted application invocations that begin failing with out-of-memory or resource allocation errors after prolonged uptime.
- System recovery only after a full device reboot rather than a service restart.
Detection Strategies
- Audit the installed OP-TEE version against the fixed release 4.11.0 and flag any deployment in the 3.3.0 to 4.10.x range.
- Review OP-TEE build configuration to determine whether non-FF-A mode with non-contiguous shared memory support is enabled.
- Instrument secure-world logging to track mobj_reg_shm allocations and releases where telemetry hooks are supported.
Monitoring Recommendations
- Monitor TEE client API return codes for allocation failures that correlate with system uptime.
- Track reboot frequency on Arm TrustZone devices running OP-TEE and correlate against trusted application workload patterns.
- Alert on kernel-side OP-TEE driver messages indicating shared memory registration or command failures.
How to Mitigate CVE-2026-42546
Immediate Actions Required
- Upgrade OP-TEE to version 4.11.0 or later, which contains the patch that applies OPTEE_MSG_ATTR_TYPE_MASK before evaluating parameter attribute types.
- Inventory all Arm Cortex-A devices with TrustZone-backed OP-TEE and prioritize systems in long-running deployments where reboot cycles are infrequent.
- Rebuild and reflash firmware images for embedded devices using the patched OP-TEE source tree.
Patch Information
The fix is included in OP-TEE 4.11.0. Refer to the OP-TEE GitHub Security Advisory GHSA-c7j8-fgqw-rcgp for the vendor advisory and patch details.
Workarounds
- No workarounds are available according to the vendor advisory. Upgrading to OP-TEE 4.11.0 is the only supported remediation.
- Where immediate upgrade is not feasible, schedule periodic reboots to reclaim leaked secure-world heap capacity as a temporary operational measure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
