CVE-2026-71969: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-71969 is a buffer underwrite (heap underflow) vulnerability in OP-TEE OS through version 4.10.0, affecting RSA NOPAD encrypt and decrypt operations in both the mbedTLS software backend and the SE050 hardware driver. A malicious Trusted Application can trigger the flaw by supplying an input length (src_len) exceeding the RSA modulus size (rsa_len); the unsigned integer subtraction rsa_len - src_len wraps to a large value, causing a memcpy to write attacker-controlled data before the destination buffer in S-EL1 secure-world heap memory. The vulnerability was disclosed on August 10, 2026, and is fixed in commit 7b8b494. It carries a CVSS v3.1 base score of 6.7 (Medium) and a CVSS v4.0 base score of 8.4 (High) (Github Advisory, Feedly).

The root cause is a missing input-length bounds check classified as CWE-124 (Buffer Underwrite / Buffer Underflow) and CWE-787 (Out-of-bounds Write). In the vulnerable code paths — sw_crypto_acipher_rsanopad_encrypt() / _decrypt() in lib/libmbedtls/core/rsa.c and encrypt_nopad() / decrypt_nopad() in core/drivers/crypto/se050/core/rsa.c — the input is left-aligned into a modulus-sized buffer via memcpy(buf + rsa_len - src_len, src, src_len). Because both rsa_len and src_len are size_t (unsigned), when src_len > rsa_len the offset underflows to a very large value, directing the memcpy to write before the start of the heap buffer. Exploitation requires a malicious Trusted Application (TA) running in the secure world with high privileges; the attack vector is local and requires no user interaction. The libtomcrypt backend and the HiSilicon/ASU drivers already performed this check and were not affected (Github PR #7898, Github PR #7808).

Successful exploitation allows a malicious Trusted Application to corrupt S-EL1 secure-world heap memory with attacker-controlled data, resulting in high confidentiality, integrity, and availability impact within the secure world context. An attacker could leverage the heap corruption to leak sensitive cryptographic material or other secrets stored in the TEE, modify security-critical data structures, or crash the secure OS. Because the secure world is isolated from the normal world, the scope is contained to the S-EL1 context; however, compromise of the TEE can undermine the security guarantees provided to all applications relying on it (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time; the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly). The discoverer (shj-byteray) noted that a reproducer is available on request but has not been publicly released (Github PR #7898). The EPSS score is approximately 0.134% (3rd percentile), reflecting a low near-term exploitation probability. Exploitation is constrained by the requirement for high privileges — specifically, the ability to deploy or execute a malicious Trusted Application in the secure world.

1. Obtain TA execution capability: Gain the ability to load and execute a Trusted Application in the OP-TEE secure world on a target device running OP-TEE OS ≤ 4.10.0. This typically requires either a compromised normal-world process with TA loading privileges or physical access to a development/debug device.
2. Craft a malicious TA: Write a Trusted Application that invokes a TEE_ALG_RSA_NOPAD encrypt or decrypt operation (via the TEE Internal Core API) using an RSA key and an input buffer whose length (src_len) exceeds the RSA modulus size (rsa_len).
3. Trigger the underflow: Submit the oversized input to the vulnerable sw_crypto_acipher_rsanopad_encrypt/decrypt (mbedTLS backend) or encrypt_nopad/decrypt_nopad (SE050 driver). The expression rsa_len - src_len wraps to a large unsigned value.
4. Achieve heap underwrite: The resulting memcpy(buf + <huge_offset>, src, src_len) writes attacker-controlled bytes before the start of the destination buffer in S-EL1 heap memory, corrupting adjacent heap metadata or sensitive data structures.
5. Leverage corruption: Use the heap corruption to overwrite security-critical data (e.g., key material, function pointers, or heap metadata) to achieve information disclosure, integrity violation, or denial of service within the secure world (Github PR #7898, Github PR #7808).

• Logs: Unexpected TEE_ERROR_BAD_PARAMETERS or memory fault/panic messages in the OP-TEE secure OS log (optee_os console output) related to RSA NOPAD operations, which may indicate probing or failed exploitation attempts.
• Process/TA Behavior: A Trusted Application invoking TEE_ALG_RSA_NOPAD with an input buffer larger than the RSA key modulus size — detectable via OP-TEE tracing/debug logs if enabled (CRYPTO_TRACE output).
• System Stability: Unexpected secure world crashes, panics, or reboots on devices running OP-TEE, which may result from heap corruption caused by exploitation attempts.
• File System: Presence of unauthorized or unrecognized Trusted Application binaries (.ta files) in the TA storage directory on the device.

The fix is available in OP-TEE OS commit 7b8b494e0a324cefec8ed386b7de413b44f1aaf3, merged on August 3, 2026, which adds input-length validation (if (cipher_len > rsa_data.key.n_size) return TEE_ERROR_BAD_PARAMETERS;) to both crypto_acipher_rsanopad_decrypt and crypto_acipher_rsanopad_encrypt in the generic crypto API layer, and a corresponding check in the SE050 driver. All deployments running OP-TEE OS ≤ 4.10.0 should update to a build containing commit 7b8b494 or later. As a workaround where patching is not immediately possible, restrict or audit the set of Trusted Applications permitted to run on the system to prevent untrusted TAs from performing RSA NOPAD operations (Github Commit, Github Advisory).

The vulnerability was discovered and reported by researcher Shahriyar Jalayeri (shj-byteray), who submitted a detailed pull request with patches for both affected backends and noted that a reproducer is available on request (Github PR #7898). OP-TEE maintainers Etienne Carriere and Jerome Forissier reviewed and approved the fix promptly, with the patch merged by Jens Wiklander on August 3, 2026 (Github PR #7808). VulnCheck published an advisory covering the issue (Github Advisory). No significant broader media coverage or social media discussion has been observed.