CVE-2026-80524 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
optee: ffa: Add NULL check in optee_ffa_lend_protmem
Sashiko (locally) reports a possible null dereference under memory pressure due to the lack of validation of the allocated pointer.
Fix that by adding the missing check.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel's OP-TEE driver, specifically within the FFA interface implementation for lending protected memory, contained a critical flaw related to improper input validation and resource management. The vulnerability stems from the function optee_ffa_lend_protmem, which is responsible for handling requests to lend physical memory regions to secure world applications via the ARM Trusted Firmware's Foreign Function Interface (FFA). Under normal operating conditions, this process involves allocating kernel memory structures to facilitate the communication and state tracking between the rich OS and the secure monitor. However, the original implementation failed to verify whether these dynamic allocations succeeded before proceeding with subsequent operations that assumed a valid pointer was returned by the allocation routine.
This oversight creates a direct path for a null pointer dereference vulnerability when system resources are constrained. In scenarios characterized by high memory pressure or fragmentation, standard kernel memory allocation functions such as kzalloc may fail to acquire the requested buffer and return NULL instead of a valid memory address. Without an explicit check against this failure condition, the driver proceeds to use the NULL pointer in subsequent logic, likely attempting to access fields or invoke callbacks associated with the allocated structure. This misuse results in a kernel panic or system crash, effectively causing a denial of service for the entire host operating system. The impact is particularly severe because it can be triggered by local users who have sufficient privileges to interact with OP-TEE devices, potentially exhausting memory resources intentionally to destabilize the system.
From a classification perspective, this flaw aligns closely with CWE-476, which denotes NULL Pointer Dereference, as well as CWE-20, Improper Input Validation, since the code failed to validate the outcome of an internal operation that is critical for safe execution flow. In terms of attack vectors and tactics, this vulnerability supports techniques associated with MITRE ATT&CK ID T1499, specifically Endpoint Denial of Service via resource exhaustion or crash induction. An attacker could leverage this weakness by repeatedly attempting memory-intensive operations through the OP-TEE interface while simultaneously inducing system-wide memory pressure, thereby increasing the probability of triggering the null dereference and crashing the kernel.
The remediation for this issue involves implementing a strict validation check immediately following any dynamic memory allocation within the optee_ffa_lend_protmem function. By verifying that the returned pointer is not NULL before proceeding with further logic, developers ensure that the driver gracefully handles allocation failures rather than executing undefined behavior. This typically includes logging an appropriate error message and returning an error code to the caller, thereby preventing the crash and maintaining system stability even under adverse resource conditions. Such defensive programming practices are essential for robust kernel development, ensuring that drivers remain resilient against both accidental resource exhaustion and targeted denial-of-service attacks aimed at destabilizing critical infrastructure components.