---
id: CVE-2026-99024
title: 'optee: register TEE devices only once fully initialized'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  optee: register TEE devices only once fully initialized

  optee_probe() called tee_device_register() on both the client and the
  supplicant device before the rest of stru…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 <
    262062c01f5a817104c88bf6eacb7c6ffdc7018d
  - >-
    Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 <
    8cae1605be8a047ae3a62df07b9474d61462c4f6
  - >-
    Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 <
    681adbc9c7a820279582a295e183fa6a1d1b4ec4
  - >-
    Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 <
    2f7240f0a6fd83df274fc0a2abf0609b4e6bd388
  - >-
    Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 <
    c108feca0a096f8db25d1b69130035025e9e936d
  - Linux 4.12
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:21:08.551Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99024'
references:
  - url: 'https://git.kernel.org/stable/c/262062c01f5a817104c88bf6eacb7c6ffdc7018d'
  - url: 'https://git.kernel.org/stable/c/8cae1605be8a047ae3a62df07b9474d61462c4f6'
  - url: 'https://git.kernel.org/stable/c/681adbc9c7a820279582a295e183fa6a1d1b4ec4'
  - url: 'https://git.kernel.org/stable/c/2f7240f0a6fd83df274fc0a2abf0609b4e6bd388'
  - url: 'https://git.kernel.org/stable/c/c108feca0a096f8db25d1b69130035025e9e936d'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.535Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

optee: register TEE devices only once fully initialized

optee_probe() called tee_device_register() on both the client and the
supplicant device before the rest of struct optee had been initialized.

tee_device_register() calls cdev_device_add(), which does two things at
once: it creates /dev/tee0 and /dev/teepriv0, and it links the device
into the tee class so that class_find_device() can find it. From that
moment on the device is reachable both from user space via tee_open()
and from kernel space via tee_client_open_context(). The only gate in
teedev_open() is tee_device_get(), which merely checks that
teedev->desc is non-NULL, which was already set by tee_device_alloc().
Therefore, there is effectively no gate at all.

A context opened in that window can run against a struct optee where

  - optee->call_queue.mutex is not initialized by optee_cq_init()
  - optee->supp mutex and completions is not initialized by
    optee_supp_init()
  - optee->rpmb_dev_mutex is not initialized yet,
  - the message argument cache is not initialized by
    optee_shm_arg_cache_init()
  - optee->ctx is still NULL

Any open session or invoke during this window takes uninitialized
mutexes and dereferences a NULL pointer.

Fix it by moving both tee_device_register() calls down to the point
where all of struct optee is set up.

[JW: adding fixes and cc]

## Affected

- `Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 < 262062c01f5a817104c88bf6eacb7c6ffdc7018d`
- `Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 < 8cae1605be8a047ae3a62df07b9474d61462c4f6`
- `Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 < 681adbc9c7a820279582a295e183fa6a1d1b4ec4`
- `Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 < 2f7240f0a6fd83df274fc0a2abf0609b4e6bd388`
- `Linux >= 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 < c108feca0a096f8db25d1b69130035025e9e936d`
- `Linux 4.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.