CVE-2025-71300

Root

Cause A prior commit added an OP-TEE node to the arm64 zynqmp device tree (zynqmp.dtsi). However, U-Boot's OP-TEE logic automatically injects a reserved-memory node and an optee firmware node into the kernel device tree, provided no manually defined optee node exists. The presence of the manually defined node in zynqmp.dtsi interferes with this automatic injection, resulting in the reserved-memory node not being inserted [1][2][3][4].

Exploitation

The vulnerability manifests at runtime on systems running U-Boot with OP-TEE support. When the device tree includes the manually defined optee node, the expected reserved-memory region is missing. This leads to memory access violations as OP-TEE attempts to use memory that is not properly reserved [1].

Impact

An attacker with local access (or any user) could cause a denial of service or system instability due to memory corruption. The exact privileges required depend on the specific system configuration, but the bug can trigger crashes or unpredictable behavior [1].

Mitigation

The fix reverts the original commit. The revert has been backported to multiple stable kernel branches as indicated in the references [1][2][3][4]. Users should apply the appropriate stable update.