CVE-2026-71967: OP-TEE OS Denial of Service Vulnerability

CVE-2026-71967 Overview

CVE-2026-71967 is a null pointer dereference vulnerability [CWE-476] in OP-TEE OS through version 4.10.0. The flaw resides in the Widevine pseudo-Trusted Application (PTA) open_session handler and affects builds where CFG_WIDEVINE_PTA is enabled. A Normal World client can open a session directly against the Widevine PTA, triggering an unconditional dereference of a NULL calling session pointer through is_user_ta_ctx(). The dereference faults the Trusted Execution Environment (TEE) at Secure EL1 and crashes the trusted execution environment. The issue is fixed in commit 0aadfc2.

Critical Impact
A local, low-privileged Normal World process can crash the TEE at S-EL1, causing denial of service to all secure-world services relying on OP-TEE.

Affected Products

OP-TEE OS versions up to and including 4.10.0
Builds compiled with CFG_WIDEVINE_PTA enabled
Fixed in OP-TEE OS commit 0aadfc23407f50e770eb5ddd871fc208f5626833

Discovery Timeline

2026-08-10 - CVE-2026-71967 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71967

Vulnerability Analysis

OP-TEE is an open-source Trusted Execution Environment implementing the GlobalPlatform TEE specification. The Widevine PTA is an internal service intended to be invoked by other Trusted Applications, not directly by Normal World clients. Its open_session entry point retrieves the calling session with ts_get_calling_session() and then calls is_user_ta_ctx(session->ctx) to verify the caller is a user TA.

When a Normal World client opens a session directly on the Widevine PTA, ts_get_calling_session() returns NULL because no calling TA session exists. The subsequent session->ctx access dereferences a NULL pointer inside secure world. The fault occurs at S-EL1 and halts TEE execution, denying service to every downstream secure service. Exploitation requires only local access and low privileges within the Normal World.

Root Cause

The handler assumed ts_get_calling_session() would always return a valid session pointer. It performed no NULL check before dereferencing the pointer to inspect the caller's context, violating defensive programming expectations for entry points reachable from the Normal World.

Attack Vector

An attacker with the ability to invoke the OP-TEE client API from the Normal World opens a session on the Widevine PTA UUID. The direct call bypasses the intended TA-to-PTA invocation path, producing the NULL calling session and triggering the crash.

// Fix in core/pta/widevine.c - reject a NULL calling session in open_session
 	struct ts_session *session = ts_get_calling_session();
 
 	/* Make sure we are called from a TA */
-	if (!is_user_ta_ctx(session->ctx))
+	if (!session || !is_user_ta_ctx(session->ctx))
 		return TEE_ERROR_ACCESS_DENIED;
 
 	/* Make sure we are called from an allowed TA */
// Source: https://github.com/OP-TEE/optee_os/commit/0aadfc23407f50e770eb5ddd871fc208f5626833

The patch adds a !session guard so that direct Normal World callers receive TEE_ERROR_ACCESS_DENIED instead of causing a fault.

Detection Methods for CVE-2026-71967

Indicators of Compromise

Unexpected TEE panics or S-EL1 abort logs from OP-TEE console output referencing pta/widevine.c
Normal World client processes issuing TEEC_OpenSession calls to the Widevine PTA UUID without going through an intermediary TA
Kernel or supplicant logs showing repeated TEE session failures after Widevine PTA invocation

Detection Strategies

Enable OP-TEE debug logging (CFG_TEE_CORE_LOG_LEVEL) to capture panic traces originating from the Widevine PTA open_session path.
Audit user-space processes with access to /dev/tee0 or /dev/teepriv0 and correlate their session-open activity against expected callers.
Instrument the OP-TEE supplicant and Linux tee driver to record PTA UUIDs targeted by Normal World clients.

Monitoring Recommendations

Alert on TEE watchdog resets or secure-world crashes recorded in the host kernel log.
Track process baselines for applications legitimately using DRM services and flag anomalous Widevine PTA session attempts.
Correlate TEE unavailability events with the invoking process identifier to identify the source of the denial of service.

How to Mitigate CVE-2026-71967

Immediate Actions Required

Update OP-TEE OS to a build containing commit 0aadfc23407f50e770eb5ddd871fc208f5626833 or a later release beyond 4.10.0.
Restrict access to the OP-TEE client devices (/dev/tee*) so only authorized processes can open PTA sessions.
Rebuild and reflash affected firmware images on devices where CFG_WIDEVINE_PTA is enabled.

Patch Information

The fix is available in the OP-TEE project via the OP-TEE OS commit 0aadfc2 and the corresponding OP-TEE Pull Request #7899. Additional context is available in the VulnCheck Security Advisory. The patch adds a NULL check on the calling session before dereferencing session->ctx, returning TEE_ERROR_ACCESS_DENIED when no calling TA session exists.

Workarounds

Disable CFG_WIDEVINE_PTA in the OP-TEE build configuration if Widevine functionality is not required on the target device.
Apply host-side access controls to prevent untrusted user-space processes from communicating with the TEE driver.
Deploy the upstream patch as an out-of-tree fix if a full OP-TEE version bump is not immediately feasible.

bash

# Rebuild OP-TEE OS without the Widevine PTA as a mitigation
make -C optee_os \
    PLATFORM=<your_platform> \
    CFG_WIDEVINE_PTA=n \
    CFG_TEE_CORE_LOG_LEVEL=3