User-After-Free Vulnerability in OP-TEE Trusted Execution Environment
CVE-2026-40290

7.8HIGH

Key Information:

Vendor

Op-tee

Status
Optee Os
Vendor
CVE Published:
3 June 2026

What is CVE-2026-40290?

A user-after-free (UAF) race condition in OP-TEE's shared memory teardown logic can be exploited when OP-TEE is configured as a Secure Partition Management Core (SPMC) with secure partitions enabled. The issue arises in versions 3.16.0 through 4.10.0, where function sp_mem_remove() fails to acquire necessary locks before freeing shared memory entries. This can lead to concurrent threads accessing freed memory, potentially allowing for unauthorized information disclosure or process manipulation. The problem has been addressed in version 4.11.0.

Affected Version(s)

optee_os >= 3.16.0, < 4.11.0

References

https://github.com/OP-TEE/optee_os/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.