CVE-2026-45702 OP-TEE has FF-A type confusion in SPMC tmem path that causes S-EL1 kernel panic

Medium 4.4 Published 3 Jun 2026 Updated 4 Jun 2026

A type confusion in OP-TEE OS causes a kernel panic when processing specific memory share requests, requiring a version upgrade to fix.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-45702?

CVE-2026-45702 is a medium-severity memory corruption vulnerability in OP-TEE optee_os, published on 3 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.3.0 and prior to version 4.11.0, a type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_CORE_SEL1_SPMC=y` and `CFG_SECURE_PARTITION=y`. Version 4.11.0 fixes the issue.

Weakness: CWE-843

Which versions are affected by CVE-2026-45702?

It affects 1 product.

Products include Trustedfirmware Op-Tee.

How do I fix CVE-2026-45702?

No fix has been published for CVE-2026-45702 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-45702 being exploited?

There is no known exploitation of CVE-2026-45702 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-45702, GHSA-86pj-8xgw-66p5, UBUNTU-CVE-2026-45702.