CVE-2026-71967: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-71967 is a NULL pointer dereference vulnerability in the Widevine pseudo-TA (Trusted Application) open_session handler of OP-TEE OS that allows low-privileged Normal World clients to crash the Trusted Execution Environment (TEE), causing a denial of service. It affects OP-TEE OS through version 4.10.0 when the CFG_WIDEVINE_PTA build option is enabled, and was fixed in commit 0aadfc2 merged on August 6, 2026. The vulnerability was publicly disclosed on August 10, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 5.7 (Medium) (Github Advisory, OP-TEE PR #7899).

The root cause is a missing NULL check (CWE-476) in core/pta/widevine.c. The open_session() function calls ts_get_calling_session() to retrieve the calling TA session, then immediately dereferences the returned pointer via is_user_ta_ctx(session->ctx) without first verifying that session is non-NULL. When a Normal World client sends an OPTEE_MSG_CMD_OPEN_SESSION message directly to the Widevine PTA — bypassing the expected TA-to-PTA call path — no calling session exists on the stack, so ts_get_calling_session() returns NULL. The subsequent dereference faults at S-EL1, panicking the TEE. The fix (a one-line change) adds a NULL guard: if (!session || !is_user_ta_ctx(session->ctx)), consistent with how other PTAs in the codebase handle this case (OP-TEE Commit, OP-TEE PR #7899).

Successful exploitation crashes the Trusted Execution Environment at S-EL1, resulting in a complete denial of service for all TEE-dependent functionality on the affected device. This includes any Trusted Applications relying on the TEE, such as DRM (Widevine), secure key storage, and other security-sensitive operations. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue — but a TEE crash may require a device reboot to restore normal operation, and could disrupt security-critical services on embedded or mobile platforms (Github Advisory).

No public proof-of-concept exploit code has been released, though the PR author noted that a reproducer is available on request. There is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.119% (2nd percentile), indicating a low near-term exploitation probability. Exploitation requires local access with low privileges and the CFG_WIDEVINE_PTA feature to be enabled, limiting the attack surface (Github Advisory, OP-TEE PR #7899).

1. Precondition check: Confirm the target device runs OP-TEE OS ≤ 4.10.0 compiled with CFG_WIDEVINE_PTA=y. This can be inferred from device firmware analysis or by attempting to enumerate available PTAs from the Normal World.
2. Obtain Normal World access: Gain local code execution in the Normal World (Linux userspace or equivalent) with at least low-privilege access — no root or special TEE client privileges are required beyond the ability to invoke the TEE client API.
3. Open a session directly on the Widevine PTA: Use the TEE client API (e.g., TEEC_OpenSession()) to send an OPTEE_MSG_CMD_OPEN_SESSION message directly to the Widevine PTA UUID, without going through an intermediary Trusted Application.
4. Trigger the NULL dereference: Because no calling TA session is on the TEE stack, ts_get_calling_session() returns NULL. The unguarded is_user_ta_ctx(session->ctx) dereference faults at S-EL1, panicking the TEE and crashing all TEE-dependent services on the device (OP-TEE PR #7899, OP-TEE Commit).

• Logs: TEE panic or fault messages at S-EL1 in the secure monitor or TEE OS logs (e.g., TEE-CORE: Panic at S-EL1 or similar OP-TEE abort messages); kernel logs showing TEE driver errors or unexpected TEE session failures.
• Process/System Behavior: Sudden unavailability of TEE-dependent services (e.g., Widevine DRM failures, secure key operations returning errors); device requiring reboot to restore TEE functionality.
• Network: No network-based IOCs — exploitation is local only.
• File System: No persistent file artifacts expected from a pure DoS exploit of this type.

The fix is available in OP-TEE OS commit 0aadfc23407f50e770eb5ddd871fc208f5626833, merged into the master branch on August 6, 2026. Operators should rebuild and redeploy OP-TEE OS with this commit applied. As a configuration-based workaround, disabling CFG_WIDEVINE_PTA at build time eliminates the vulnerable code path entirely if Widevine support is not required. Additionally, restricting Normal World access to the TEE client interface (e.g., limiting which processes can invoke TEEC_OpenSession) can reduce exposure (OP-TEE Commit, Github Advisory).

The vulnerability was discovered and reported by Shahriyar Jalayeri (shj-byteray) and reviewed by Etienne Carriere, both OP-TEE contributors. The fix was reviewed and merged by OP-TEE maintainer jenswikl after CI tests passed. The disclosure was coordinated through VulnCheck, which assigned the CVE. Community reaction has been minimal given the narrow impact scope (requires CFG_WIDEVINE_PTA enabled and local access), and no significant media coverage or broader security community discussion has been observed (OP-TEE PR #7899).