CVE-2026-71967

A null-pointer dereference in Widevine's pseudo-TA (PTA) open_session handler exposes a structural weakness in OP-TEE's trust model. The bug is straightforward: is_user_ta_ctx() receives NULL and unconditionally dereferences it, triggering a synchronous S-EL1 abort. What matters is the blast radius. Unlike user-mode Trusted Applications that execute in isolated S-EL0 contexts, pseudo-TAs run within the TEE core itself. When Widevine PTA faults, it doesn't crash a process—it crashes the entire trusted execution environment, potentially leaving secure world state (cryptographic keys, session handles for other TAs) in an inconsistent state while Normal World still holds references to it. A clean panic halts the TEE, but recovery isn't instantaneous, and the CVSS 5.5 rating badly understates the availability impact: this isn't a process restart, it's a TEE restart that blocks every secure world consumer. The CFG_WIDEVINE_PTA configuration flag gates this attack surface, limiting scope to systems with this option enabled. However, any privileged Normal World caller can invoke the open_session entry point—a low bar in the OP-TEE threat model. The deeper concern is whether this vulnerability is an outlier or a pattern. Pseudo-TAs under the CFG_<VENDOR>_PTA pattern have produced CVEs before: vendor-provided code gets integrated into the TEE core with minimal scrutiny, linked without formal verification that it meets the same defensive standards as core OP-TEE components. The integration boundary has no owner. There's no mandatory fuzzing or static analysis harness that exercises PTA entry points with adversarial inputs, and the build system enforces nothing at the pseudo-TA boundary. This isn't just Widevine's problem—it's a class of vulnerability waiting to surface in any vendor PTA. Prioritise: verify whether CFG_WIDEVINE_PTA is enabled in your builds; if so, obtain the patched version from your SoC vendor immediately. Treat this as a critical availability failure, not a low-severity DoS. The exposure window—between disclosure and fleet patching—matters more here than typical CVEs, because the TEE doesn't auto-recover. Also audit any other CFG_<VENDOR>_PTA configurations in your deployment for similar input-validation gaps. This vulnerability is the symptom; the systemic risk is vendor PTA code integrated without systematic boundary testing.

Reviewed through automated stages and approved by a human before publication.