The flaw exists in the Linux kernel’s OP‑TEE integration. During the device probe the kernel registers the TEE character nodes before the device structure is fully initialized. The early registration allows user‑space and kernel‑space opens while mutexes, completions, and other fields remain uninitialized or NULL. Subsequent session or invoke attempts dereference these NULL pointers, which triggers a kernel panic. The consequence is a denial of service by crashing the kernel; no remote code execution is described.

The issue is present in all Linux kernel releases that include the OP‑TEE subsystem before the patch that moves the device registration after full initialization. Every distribution that ships the default OP‑TEE integration is impacted until a kernel update that fixes the early registration is applied.

The CVSS score is 4.7, and the EPSS score is < 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered by a local user opening /dev/tee0 or /dev/teepriv0 immediately after system boot, it is exploitable by local attackers. The attack path is straightforward: open the device during the narrow initialization window to provoke a kernel panic, resulting in a system‑wide denial of service. The lack of a remote vector limits the surface but the potential for complete system failure makes it high concern.