The vulnerability originates from a use‑after‑free in the Trusted Application loader of OP‑TEE OS. By setting the TA_FLAG_CONCURRENT flag in a signed TA header, an attacker who can load a Trusted Application can cause two concurrent sessions to share a context without proper locking. This race condition corrupts the uctx->vm_info.regions list and frees vm_region nodes that are still in use, leading to a use‑after‑free in secure‑world kernel memory. The result is the ability for an attacker to corrupt kernel memory, which may be escalated to arbitrary code execution. This corresponds to CWE‑416 and CWE‑362.

Vendors: OP‑TEE; product: OP‑TEE Operating System. The flaw exists in all releases up to and including version 4.10.0. It is fixed by the commit identified by the hash 8794043c4065c26a2b8b1313794ba5ba5f06d296. Earlier versions that have not applied this patch are vulnerable.

The CVSS base score is 8.4, indicating a high severity. The EPSS metric is not available, so the current exploitation probability is unknown; the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to load a signed Trusted Application, which is typically a privilege level higher than a regular user but lower than root. Thus the attack vector is inferred to be local or privileged. Given the severity and the nature of the use‑after‑free, early remediation is recommended.