CVE-2026-80524 Overview
CVE-2026-80524 is a null pointer dereference vulnerability in the Linux kernel's OP-TEE (Open Portable Trusted Execution Environment) driver. The flaw resides in the optee_ffa_lend_protmem function, which implements the Firmware Framework for Arm A-profile (FF-A) protected memory lending path. Under memory pressure, an allocation inside this function can fail and return NULL, but the code path did not validate the returned pointer before dereferencing it. A local actor able to trigger the protected-memory lending code path can cause the kernel to dereference a null pointer, resulting in a kernel crash.
Critical Impact
Local null pointer dereference in the OP-TEE FF-A driver leads to a kernel oops and denial of service on affected Linux systems using OP-TEE with FF-A transport.
Affected Products
- Linux kernel builds including the OP-TEE driver with FF-A transport support
- Systems using Arm TrustZone-based OP-TEE with protected memory lending via FF-A
- Distribution kernels tracking the mainline optee subsystem prior to the fix commits
Discovery Timeline
- 2026-08-26 - CVE-2026-80524 published to the National Vulnerability Database
- 2026-08-26 - Last updated in the NVD database
Technical Details for CVE-2026-80524
Vulnerability Analysis
The defect lives in the OP-TEE FF-A transport layer, specifically in optee_ffa_lend_protmem. This function is invoked when the OP-TEE driver lends a protected memory region to secure world using the Arm FF-A mechanism. The routine performs a dynamic allocation to represent the shared memory descriptor. When the system is under memory pressure, that allocation can return NULL. The original code path proceeded to use the returned pointer without confirming the allocation succeeded, producing a classic null pointer dereference in kernel context.
Because the fault occurs in kernel mode, the outcome is a kernel oops, which typically terminates the offending task and can leave kernel subsystems in an inconsistent state. On systems where OP-TEE services are integral to platform functionality such as secure key storage, DRM playback, or trusted UI, the resulting instability affects availability of dependent user-space services.
Root Cause
The root cause is missing validation of an allocated pointer prior to use, classified as [CWE-476] Null Pointer Dereference. The reporter, identified in the upstream changelog as Sashiko, observed the issue locally while exercising the protected memory lending path under constrained memory conditions. The upstream fix adds the missing NULL check so that the function returns an error to the caller instead of dereferencing an invalid pointer.
Attack Vector
Exploitation requires local access to a system that exposes OP-TEE FF-A functionality to callable code paths. An actor that can invoke the protected memory lending operation, combined with induced memory pressure, can reliably reach the vulnerable allocation. The impact is limited to denial of service; there is no indication in the advisory data that the flaw enables privilege escalation or memory disclosure. See the upstream fix commits referenced below for the exact code path.
Refer to the Kernel Stable Commit 650c8873 and Kernel Stable Commit 94bf4fe0 for the patched implementation.
Detection Methods for CVE-2026-80524
Indicators of Compromise
- Kernel oops or panic entries in dmesg or journalctl -k referencing optee_ffa_lend_protmem in the call trace.
- Repeated NULL pointer dereference faults originating from the OP-TEE FF-A code path on Arm platforms.
- Unexpected termination of user-space processes that rely on OP-TEE-backed trusted applications following memory-pressure events.
Detection Strategies
- Inventory hosts running the OP-TEE driver by checking for CONFIG_OPTEE=y or the optee module and confirming FF-A transport is active.
- Compare the running kernel version against the fix commits 650c8873 and 94bf4fe0 in the stable tree to determine patch status.
- Instrument fleet telemetry to capture kernel oops events and correlate them with OP-TEE-related stack frames.
Monitoring Recommendations
- Forward kernel logs to a centralized data lake and alert on stack traces containing optee_ffa symbols.
- Track memory pressure metrics on Arm devices running OP-TEE workloads to identify pre-conditions for the fault.
- Monitor process crash counters for services that depend on OP-TEE, such as tee-supplicant.
How to Mitigate CVE-2026-80524
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 650c88738ae8 and 94bf4fe0e463 to the OP-TEE FF-A driver.
- Rebuild and redeploy custom or vendor kernels on Arm platforms that ship OP-TEE with FF-A transport.
- Restrict local access to systems exposing OP-TEE trusted application interfaces until patched kernels are deployed.
Patch Information
The fix adds the missing NULL check on the allocated pointer in optee_ffa_lend_protmem, returning an error to the caller when allocation fails. The patch is available in the Linux stable tree via commit 650c8873 and commit 94bf4fe0. Distribution maintainers should backport these commits to any supported branches that carry the OP-TEE FF-A driver.
Workarounds
- Disable or unload the OP-TEE driver on systems where trusted execution services are not required.
- Reduce exposure to memory-pressure conditions by tuning workload limits and cgroup memory constraints on affected hosts.
- Limit which local users and services can invoke OP-TEE client interfaces such as /dev/tee0 and /dev/teepriv0 through file-system permissions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
