CVE-2026-90094: arm64: process: Fix context switching MTE store-only tag check
In the Linux kernel, the following vulnerability has been resolved:
arm64: process: Fix context switching MTE store-only tag check
SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear SCTLREL1.TCSO0, so we are leaking that setting into another task.
Fix that by including SCTLREL1TCSO0MASK into SCTLRUSERMASK
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems running on arm64 where Memory Tagging Extension (MTE) store-only tag checking can be enabled by a user task. The leaked setting can affect a different task after a context switch.
What must occur for the setting to leak between tasks?
A task must opt in to MTE store-only tag check mode, which sets SCTLR_EL1.TCSO0. A subsequent context switch can leave that setting enabled for another task because it was not included in the user SCTLR state cleared or restored during switching.
How can this be remediated?
Apply a Linux kernel update containing the fix that adds SCTLR_EL1_TCSO0_MASK to SCTLR_USER_MASK. The provided stable kernel references identify commits carrying the correction.