{
  "affected": [
    {
      "affectedData": [
        {
          "product": "optee_os",
          "vendor": "OP-TEE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.16.0, \u003c 4.11.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:trustedfirmware:op-tee:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "524C2815-ED30-481B-BD34-E6A09099AD84",
              "versionEndIncluding": "4.10.0",
              "versionStartIncluding": "3.16.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.16.0 and prior to 4.11.0, a user-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A  within OP-TEE SPMC/SP flows. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_SECURE_PARTITION=y`. The function `sp_mem_remove()`, responsible for freeing entries in `smem-\u003ereceivers` and `smem-\u003eregions`, fails to acquire the global `sp_mem_lock` before performing the `free()` operations. Concurrently, other code paths, such as `sp_mem_get_receiver()`, iterate over these same lists without holding a lock, or, like `sp_mem_is_shared()`, iterate while holding the lock but are not serialized against the unprotected `free()` in `sp_mem_remove()`. This creates a cross-thread race where a thread iterating the list can acquire a pointer to an entry (e.g., `struct sp_mem_map_region` or `struct sp_mem_receiver`), and then another thread calls `sp_mem_remove()`, freeing the object. When the first thread resumes and dereferences the pointer, it results in a Use-After-Free vulnerability. Version 4.11.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "OP-TEE es un Entorno de Ejecuci\u00f3n Confiable (TEE) dise\u00f1ado como compa\u00f1ero de un kernel de Linux no seguro que se ejecuta en n\u00facleos Arm; Cortex-A utilizando la tecnolog\u00eda TrustZone. A partir de la versi\u00f3n 3.16.0 y antes de la 4.11.0, existe una condici\u00f3n de carrera de uso despu\u00e9s de liberaci\u00f3n (UAF) en la l\u00f3gica de desmantelamiento de memoria compartida de FF-A dentro de los flujos SPMC/SP de OP-TEE. Esto solo aplica cuando OP-TEE est\u00e1 configurado como un SPMC para SPs S-EL0, es decir, con \u0027CFG_SECURE_PARTITION=y\u0027. La funci\u00f3n \u0027sp_mem_remove()\u0027, responsable de liberar entradas en \u0027smem-\u003ereceivers\u0027 y \u0027smem-\u003eregions\u0027, no logra adquirir el \u0027sp_mem_lock\u0027 global antes de realizar las operaciones de \u0027free()\u0027. Concurrentemente, otras rutas de c\u00f3digo, como \u0027sp_mem_get_receiver()\u0027, iteran sobre estas mismas listas sin mantener un bloqueo, o, como \u0027sp_mem_is_shared()\u0027, iteran mientras mantienen el bloqueo pero no est\u00e1n serializadas contra el \u0027free()\u0027 desprotegido en \u0027sp_mem_remove()\u0027. Esto crea una condici\u00f3n de carrera entre hilos donde un hilo que itera la lista puede adquirir un puntero a una entrada (p. ej., \u0027struct sp_mem_map_region\u0027 o \u0027struct sp_mem_receiver\u0027), y luego otro hilo llama a \u0027sp_mem_remove()\u0027, liberando el objeto. Cuando el primer hilo se reanuda y desreferencia el puntero, resulta en una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n. La versi\u00f3n 4.11.0 corrige el problema."
    }
  ],
  "id": "CVE-2026-40290",
  "lastModified": "2026-07-21T19:10:00.107",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40290",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-04T14:17:15.528743Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-03T18:16:23.707",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OP-TEE/optee_os/security/advisories/GHSA-332c-xr93-849m"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OP-TEE/optee_os/security/advisories/GHSA-332c-xr93-849m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}