In the Linux kernel, the following vulnerability has been resolved:
tee: optee: Fix supplicant wait loop
OP-TEE supplicant is a user-space daemon and it's possible for it be hung or crashed or killed in the middle of processing an OP-TEE RPC call. It becomes more complicated when there is incorrect shutdown ordering of the supplicant process vs the OP-TEE client application which can eventually lead to system hang-up waiting for the closure of the client application.
Allow the client process waiting in kernel for supplicant response to be killed rather than indefinitely waiting in an unkillable state. Also, a normal uninterruptible wait should not have resulted in the hung-task watchdog getting triggered, but the endless loop would.
This fixes issues observed during system reboot/shutdown when supplicant got hung for some reason or gets crashed/killed which lead to client getting hung in an unkillable state. It in turn lead to system being in hung up state requiring hard power off/on to recover.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21871.json",
"cna_assigner": "Linux"
}[
{
"target": {
"file": "drivers/tee/optee/supp.c"
},
"id": "CVE-2025-21871-4f1079e4",
"digest": {
"line_hashes": [
"256529787566799711270235390002289332331",
"84242404604870256818340418625764242063",
"247070523343687812556156741416146970879",
"45278189811107958648900453453254047556",
"161319879607313741321161123734472159496",
"227719995468522385871022563603474374572",
"134834907887955515724234524867695626801",
"64410601596738065683421915084834081541",
"289340802357288186968491959813452472860",
"273824316203491171962645994600497419000",
"270484774079919582527825874797284072176",
"14875564811760227681481530016720530192",
"148483939216037321210913496691752668781",
"259803905947643942624877764738326169512",
"239584903296817793770379363898752704811",
"93569942212158219014580720506039987866",
"104668660637422373286037901775020173440",
"210129952549078882474927114788515912588",
"84991547362758363462748599301374718205",
"291308041403364072640557115764594099330",
"120355061823288778042927313542901938803"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21234efe2a8474a6d2d01ea9573319de7858ce44",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"target": {
"function": "optee_supp_thrd_req",
"file": "drivers/tee/optee/supp.c"
},
"id": "CVE-2025-21871-ed0f401b",
"digest": {
"function_hash": "13263973235094239582799039142649923945",
"length": 958.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21234efe2a8474a6d2d01ea9573319de7858ce44",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21871.json"