In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee_probe() called… (CVE-2026-99024)

The Linux kernel OP-TEE driver had a flaw where tee_device_register() was invoked on both client and supplicant devices before the entire struct optee was initialized. This premature registration created device nodes (/dev/tee0 and /dev/teepriv0) and linked devices into the tee class, making them accessible from user and kernel space. Since the only check in teedev_open() was that teedev->desc was non-NULL (already set), there was effectively no protection against accessing the device during this window. Consequently, any session opened or invocation made during this period could operate on uninitialized mutexes and dereference NULL pointers, risking kernel instability or crashes. The fix involved moving tee_device_register() calls to after the full initialization of struct optee.

During the window when devices were registered prematurely, operations could access uninitialized mutexes and dereference NULL pointers, potentially causing kernel crashes or undefined behavior. This could affect system stability and reliability but does not explicitly state privilege escalation or code execution impacts.

A fix is available that moves the tee_device_register() calls to after the full initialization of the struct optee. Users should apply the official Linux kernel updates that include this fix. No alternative mitigations are indicated.