Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U H H H 7.8 .0019 8.7 —
AFFECTED Product Versions Fixed optee_os >= 3.16.0, < 4.11.0 – —
TIMELINE Apr 10 Reserved by GitHub_M Jun 3 EXPLOIT PUBLISHED — CVE-2026-40290 (OP-TEE optee_os). Public exploit reference added. Jun 3 Published (CNA: GitHub_M)
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.16.0 and prior to 4.11.0, a user-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A within OP-TEE SPMC/SP flows. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, that is, with `CFG_SECURE_PARTITION=y`. The function `sp_mem_remove()`, responsible for freeing entries in `smem->receivers` and `smem->regions`, fails to acquire the global `sp_mem_lock` before performing the `free()` operations. Concurrently, other code paths, such as `sp_mem_get_receiver()`, iterate over these same lists without holding a lock, or, like `sp_mem_is_shared()`, iterate while holding the lock but are not serialized against the unprotected `free()` in `sp_mem_remove()`. This creates a cross-thread race where a thread iterating the list can acquire a pointer to an entry (e.g., `struct sp_mem_map_region` or `struct sp_mem_receiver`), and then another thread calls `sp_mem_remove()`, freeing the object. When the first thread resumes and dereferences the pointer, it results in a Use-After-Free vulnerability. Version 4.11.0 fixes the issue.
| Date | Event | Detail |
|---|---|---|
| April 10, 2026 | Reserved | Reserved by GitHub_M |
| June 3, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-40290 (OP-TEE optee_os). Public exploit reference added. |
| June 3, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| OP-TEE | optee_os | — | >= 3.16.0, < 4.11.0 | — |
Authoritative record: CVE-2026-40290 at cve.org
Vendors: op-tee
Weaknesses: CWE-416
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-40290 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.