CVE-2026-71969

This CVE is being misread as an integer wrap vulnerability when the real issue is a trust boundary collapse. A Trusted Application exploiting the RSA NOPAD input validation in OP-TEE can trigger an integer underwrite (src_len - rsa_len wrapping to a large value, causing memcpy to write before the destination buffer) that lands in S-EL1 secure-world heap—the memory region containing TEE core structures that enforce TA isolation. The CVSS 6.7 rating obscures the privilege inversion here: you're not evaluating an external attacker, you're evaluating an attacker who has already subverted application-level isolation and is now moving laterally into TEE-core-privilege. That's a fundamentally different threat model than the score implies. The dual-backend manifestation (both mbedTLS software and SE050 hardware drivers consuming from the same validation layer) is the critical detail. The bug lives in OP-TEE's RSA input validation code that feeds both implementations, not in the crypto code itself. This makes the vulnerability a single point of failure with two detonation surfaces—exploitation corrupts software crypto heap and potentially propagates malformed parameters into the SE050 hardware subsystem's internal state. The SE050 path also introduces a cross-vendor remediation problem: OP-TEE and SE050 have different CVE processes and firmware update cadences, meaning the software fix may be committed while hardware deployments remain vulnerable for months. The NOPAD RSA path where this lives is telling. It exists for legacy protocol compatibility, not active development—a forgotten-but-reachable interface whose validation assumptions were never revisited as the TA threat model shifted from "debugged client code" to "potentially malicious." This follows a documented genetic sequence in OP-TEE CVE history: CVE-2020-10249, CVE-2019-6509, and earlier TrustedFirmware-A entries all feature untrusted length fields flowing into C integer arithmetic without atomic validation. The pattern isn't accidental—it's institutional. Each instance gets patched, the guidance "validate length before arithmetic" gets repeated, and then institutional memory decays past the point of vigilance. For defenders: apply the commit 7b8b494 patch immediately, but treat this as a class indicator, not an isolated incident. Audit other NOPAD and legacy crypto paths for the same src_len <= rsa_len invariant violation. Verify whether your SE050 deployment requires separate firmware remediation and factor that into your exposure timeline. Treat any integer length parameter in TEE-to-TA interfaces as a security-critical contract requiring formal specification—not a parameter to pass through naively. The patch fixes this instance; the systemic condition that produced it persists.

Reviewed through automated stages and approved by a human before publication.