CVE-2026-99024: optee: register TEE devices only once fully initialized

In the Linux kernel, the following vulnerability has been resolved:

optee: register TEE devices only once fully initialized

opteeprobe() called teedeviceregister() on both the client and the supplicant device before the rest of struct optee had been initialized.

teedeviceregister() calls cdevdeviceadd(), which does two things at once: it creates /dev/tee0 and /dev/teepriv0, and it links the device into the tee class so that classfinddevice() can find it. From that moment on the device is reachable both from user space via teeopen() and from kernel space via teeclientopencontext(). The only gate in teedevopen() is teedeviceget(), which merely checks that teedev->desc is non-NULL, which was already set by teedevicealloc(). Therefore, there is effectively no gate at all.

A context opened in that window can run against a struct optee where

- optee->callqueue.mutex is not initialized by opteecqinit() - optee->supp mutex and completions is not initialized by opteesuppinit() - optee->rpmbdevmutex is not initialized yet, - the message argument cache is not initialized by opteeshmargcacheinit() - optee->ctx is still NULL

Any open session or invoke during this window takes uninitialized mutexes and dereferences a NULL pointer.

Fix it by moving both teedeviceregister() calls down to the point where all of struct optee is set up.

[JW: adding fixes and cc]