CVE-2025-71300 (GCVE-0-2025-71300)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:15 – Updated: 2026-08-05 12:12
VLAI
Title
Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe. OP-TEE logic in U-Boot automatically injects a reserved-memory node along with optee firmware node to kernel device tree. The injection logic is dependent on that there is no manually defined optee node. Having the node in zynqmp.dtsi effectively breaks OP-TEE's insertion of the reserved-memory node, causing memory access violations during runtime.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 06d22ed6b6635b17551f386b50bb5aaff9b75fbe , < eece81eeda10eb42c687399fb5aa69977ae15664 (git)
Affected: 06d22ed6b6635b17551f386b50bb5aaff9b75fbe , < 3983ef126e439900bbf419724a9759863c146660 (git)
Affected: 06d22ed6b6635b17551f386b50bb5aaff9b75fbe , < 2a833c730d4e8d1cc10953270ce0f3a156145d81 (git)
Affected: 06d22ed6b6635b17551f386b50bb5aaff9b75fbe , < c197179990124f991fca220d97fac56779a02c6d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/boot/dts/xilinx/zynqmp.dtsi"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eece81eeda10eb42c687399fb5aa69977ae15664",
              "status": "affected",
              "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe",
              "versionType": "git"
            },
            {
              "lessThan": "3983ef126e439900bbf419724a9759863c146660",
              "status": "affected",
              "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe",
              "versionType": "git"
            },
            {
              "lessThan": "2a833c730d4e8d1cc10953270ce0f3a156145d81",
              "status": "affected",
              "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe",
              "versionType": "git"
            },
            {
              "lessThan": "c197179990124f991fca220d97fac56779a02c6d",
              "status": "affected",
              "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/boot/dts/xilinx/zynqmp.dtsi"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"arm64: zynqmp: Add an OP-TEE node to the device tree\"\n\nThis reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.\n\nOP-TEE logic in U-Boot automatically injects a reserved-memory\nnode along with optee firmware node to kernel device tree.\nThe injection logic is dependent on that there is no manually\ndefined optee node. Having the node in zynqmp.dtsi effectively\nbreaks OP-TEE\u0027s insertion of the reserved-memory node, causing\nmemory access violations during runtime."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker with local code execution can reach the failure through ordinary memory-allocation paths and, in static shared-memory deployments, through normal TEE-device ioctls; no network or physical access is required.\nAC:L - Once the affected ZynqMP OP-TEE boot flow is present, the attacker controls memory pressure or shared-memory allocation without needing an uncontrollable race or victim state.\nPR:L - An unprivileged local process can create memory pressure through ordinary mappings, and the normal TEE client interface has no capability check where device permissions permit client access.\nUI:N - The attacker can trigger allocations and access the conflicting physical pages directly, without another user performing any action.\nS:U - The resulting corruption, privilege escalation, or denial of service affects the Linux kernel and host resources within the same security authority.\nC:H - In supported static-shared-memory configurations, the missing reservation lets Linux\u0027s buddy allocator and the OP-TEE pool own the same physical pages, allowing mapped TEE shared memory to expose sensitive kernel or process data.\nI:H - The overlapping ownership provides attacker-writable aliases to pages that Linux can use for kernel objects or other allocations, making arbitrary corruption and control-flow hijacking plausible.\nA:H - Linux may allocate secure OP-TEE pages as normal RAM, causing synchronous external aborts and kernel crashes, while shared-memory aliasing can independently produce fatal memory corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:43.409Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eece81eeda10eb42c687399fb5aa69977ae15664"
        },
        {
          "url": "https://git.kernel.org/stable/c/3983ef126e439900bbf419724a9759863c146660"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a833c730d4e8d1cc10953270ce0f3a156145d81"
        },
        {
          "url": "https://git.kernel.org/stable/c/c197179990124f991fca220d97fac56779a02c6d"
        }
      ],
      "title": "Revert \"arm64: zynqmp: Add an OP-TEE node to the device tree\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71300",
    "datePublished": "2026-05-08T13:15:21.406Z",
    "dateReserved": "2026-05-08T13:14:33.087Z",
    "dateUpdated": "2026-08-05T12:12:43.409Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71300",
      "date": "2026-08-24",
      "epss": "0.00145",
      "percentile": "0.04029"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71300\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T14:16:31.387\",\"lastModified\":\"2026-07-30T06:24:57.657\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRevert \\\"arm64: zynqmp: Add an OP-TEE node to the device tree\\\"\\n\\nThis reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.\\n\\nOP-TEE logic in U-Boot automatically injects a reserved-memory\\nnode along with optee firmware node to kernel device tree.\\nThe injection logic is dependent on that there is no manually\\ndefined optee node. Having the node in zynqmp.dtsi effectively\\nbreaks OP-TEE\u0027s insertion of the reserved-memory node, causing\\nmemory access violations during runtime.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/boot/dts/xilinx/zynqmp.dtsi\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"06d22ed6b6635b17551f386b50bb5aaff9b75fbe\",\"lessThan\":\"eece81eeda10eb42c687399fb5aa69977ae15664\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06d22ed6b6635b17551f386b50bb5aaff9b75fbe\",\"lessThan\":\"3983ef126e439900bbf419724a9759863c146660\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06d22ed6b6635b17551f386b50bb5aaff9b75fbe\",\"lessThan\":\"2a833c730d4e8d1cc10953270ce0f3a156145d81\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"06d22ed6b6635b17551f386b50bb5aaff9b75fbe\",\"lessThan\":\"c197179990124f991fca220d97fac56779a02c6d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/boot/dts/xilinx/zynqmp.dtsi\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"F8A1C6F6-2847-4C53-ABFC-8F07D96900D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2a833c730d4e8d1cc10953270ce0f3a156145d81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3983ef126e439900bbf419724a9759863c146660\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c197179990124f991fca220d97fac56779a02c6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eece81eeda10eb42c687399fb5aa69977ae15664\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:13:17+00:00",
      "cve": "CVE-2025-71300",
      "id": "CVE-2025-71300",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Revert \"arm64: zynqmp: Add an OP-TEE node to the device tree\"",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71300.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-21T01:23:27Z",
      "cve": "CVE-2025-71300",
      "id": "CVE-2025-71300",
      "initial_release_date": "2026-05-12T03:34:09Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "278",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71300",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71300.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.