CVE-2026-80524

A flaw was found in the Linux kernel's OP-TEE (Open Portable Trusted Execution Environment) Fast Fault-tolerant Architecture (FFA) component. A local attacker could exploit a missing null check when allocating protected memory. Under specific memory pressure conditions, this could lead to a null pointer dereference, potentially causing a system crash and a denial of service.

A MODERATE severity flaw was found in the Linux kernel's OP-TEE FFA subsystem. When lending protected memory, the optee_ffa_lend_protmem() function did not validate the allocated pointer against NULL. Under memory pressure, a local attacker with low privileges could trigger a NULL pointer dereference, causing a kernel crash and denial of service. The flaw affects only availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); there is no impact on confidentiality or integrity. All Red Hat Enterprise Linux 6, 7, 8, 9, and 10 and Red Hat In-Vehicle OS 2 offerings (kernel, kernel-rt, and kernel-ivos-qualcomm components) are not affected because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.