CVE-2026-44362
Description
A flaw was found in OP-TEE, a Trusted Execution Environment (TEE) for Arm Cortex-A cores. This vulnerability allows a local attacker to bypass subkey rollback protection due to a failure in propagating versioning data during the Trusted Application (TA) loading process. Specifically, the system incorrectly processes subkey headers, preventing the rollback database from advancing. This enables the successful loading of Trusted Applications signed with revoked or older subkey versions, potentially compromising the integrity of the secure environment.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Modify Application Data; Other
Integrity checks usually use a secret key that helps authenticate the data origin. Skipping integrity checking generally opens up the possibility that new data from an invalid source can be injected.
Integrity,Other
Technical Impact: Other
Data that is parsed and used may be corrupted.
Non-Repudiation,Other
Technical Impact: Hide Activities; Other
Without a checksum check, it is impossible to determine if any changes have been made to the data after it was sent.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
