# CVE-2026-99024: optee: register TEE devices only once fully initialized


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 23 Oct 2026
- **Updated:** 23 Oct 2026
- **Also known as:** AZL-110876, BELL-CVE-2026-99024, DEBIAN-CVE-2026-99024, GHSA-qp8f-jjvm-547w, UBUNTU-CVE-2026-99024

## What is CVE-2026-99024?

CVE-2026-99024 is a vulnerability in Linux, published on 23 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

optee: register TEE devices only once fully initialized

optee_probe() called tee_device_register() on both the client and the
supplicant device before the rest of struct optee had been initialized.

tee_device_register() calls cdev_device_add(), which does two things at
once: it creates /dev/tee0 and /dev/teepriv0, and it links the device
into the tee class so that class_find_device() can find it. From that
moment on the device is reachable both from user space via tee_open()
and from kernel space via tee_client_open_context(). The only gate in
teedev_open() is tee_device_get(), which merely checks that
teedev->desc is non-NULL, which was already set by tee_device_alloc().
Therefore, there is effectively no gate at all.

A context opened in that window can run against a struct optee where

  - optee->call_queue.mutex is not initialized by optee_cq_init()
  - optee->supp mutex and completions is not initialized by
    optee_supp_init()
  - optee->rpmb_dev_mutex is not initialized yet,
  - the message argument cache is not initialized by
    optee_shm_arg_cache_init()
  - optee->ctx is still NULL

Any open session or invoke during this window takes uninitialized
mutexes and dereferences a NULL pointer.

Fix it by moving both tee_device_register() calls down to the point
where all of struct optee is set up.

[JW: adding fixes and cc]

## Which versions are affected by CVE-2026-99024?


## How do I fix CVE-2026-99024?

Upgrade to a fixed version.

## Is CVE-2026-99024 being exploited?

There is no known exploitation of CVE-2026-99024 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-99024 and fix it if it is affected.

What it is: CVE-2026-99024 is a vulnerability in Linux, published on 23 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-99024 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-99024/ (Markdown: https://insights.sbomify.com/CVE-2026-99024/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99024
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99024
- OSV: https://osv.dev/vulnerability/CVE-2026-99024

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-99024/
Summaries are generated and may contain mistakes; the official description above is the record.