CVE-2026-56941

In multiple functions of fpcteehal.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-92319

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in multiple functions within fpc tee hal.c allows for a use-after-free condition. This occurs when a program continues to use a pointer after it ha...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tee: added a overflow check in registershmhelper When special lengths are provided by the user space, registershmhelper may cause an integer overflow when calculating the number of pages covered by a given user space memory regio...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: tee: amdtee: fixed an issue where ISERR returned NULL instead of an error pointer. The getfreepages function no longer returns error pointers; it now returns NULL. Therefore, this condition needs to be corrected to prevent NUL...

HermiCache: Enclave-Aware Cache Replacement for Trusted Execution Environments

Trusted Execution Environments TEEs protect enclave memory from untrusted software but remain vulnerable to cache-based side-channel attacks due to shared microarchitectural resources. Existing countermeasures use techniques such as cache partitioning or randomization: these solutions are not ide...

Linux kernel Trusted Execution Environment register_shm_helper Heap Buffer Overflow DoS

The vulnerability of the registershmhelper function in the drivers/tee/teeshm.c file of the Linux kernel’s trusted execution environment driver relates to the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker to cause a service...

SUSE CVE-2026-80524

In the Linux kernel, the following vulnerability has been resolved: optee: ffa: Add NULL check in opteeffalendprotmem Sashiko locally reports a possible null dereference under memory pressure due to the lack of validation of the allocated pointer. Fix that by adding the missing check...

CVE-2026-80524

A flaw was found in the Linux kernel's OP-TEE Open Portable Trusted Execution Environment Fast Fault-tolerant Architecture FFA component. A local attacker could exploit a missing null check when allocating protected memory. Under specific memory pressure conditions, this could lead to a null...

PRISM: Lightweight Enclave Isolation with Prismatic Capabilities

Trusted execution environments TEEs protect sensitive code and data from external interference, but lack inherent memory safety. CHERI can enforce spatial memory safety at the object level. Attempts to establish a TEE using CHERI primitives suffer from 1 expensive capability revocation operations...

Benchmarking Confidential Computing Performance on NVIDIA Blackwell GPUs

This paper measures the performance impact of running large language model inference and training inside a Trusted Execution Environment TEE on NVIDIA B200 GPUs, using Intel Trust Domain Extensions TDX confidential VMs together with NVIDIA Confidential Computing CC on Blackwell GPUs. The...

Securing Filesystems for Confidential Computing

Confidential computing protects applications inside Trusted Execution Environments TEEs, but it leaves storage vulnerable. Even with disk encryption, a malicious cloud provider can roll back, replay, fork, or tamper with disk state, breaking the integrity and freshness guarantees required by...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099754)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099754 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocat...

Linux kernel cryptographic accelerator driver Heap Buffer Overflow DoS

The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100743)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100743 advisory. In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a19...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100293)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100293 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smcspdpriv when tee duplicates splice pipe buffer smcrxsplice allocat...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099790)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099790 advisory. In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a19...

DEBIAN-CVE-2026-71968

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

CVE-2026-71969

OP-TEE OS through 4.10.0, fixed in commit 7b8b494, contains a buffer underwrite vulnerability in the RSA NOPAD encrypt and decrypt operations within the mbedTLS software backend and SE050 hardware driver that allows a malicious Trusted Application to corrupt secure-world heap memory by supplying ...

CVE-2026-71968

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

CVE-2026-71967

OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability in the Widevine pseudo-TA opensession handler that allows Normal World clients to cause a denial of service when CFGWIDEVINEPTA is enabled. Attackers can open a session directly on the Widevine PT...