CVE-2026-90094: arm64: process: Fix context switching MTE store-only tag check
In the Linux kernel, the following vulnerability has been resolved:
arm64: process: Fix context switching MTE store-only tag check
SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear SCTLREL1.TCSO0, so we are leaking that setting into another task.
Fix that by including SCTLREL1TCSO0MASK into SCTLRUSERMASK
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Include SCTLR_EL1_TCSO0_MASK in SCTLR_USER_MASK so SCTLR_EL1.TCSO0 is cleared during context switches.
Linux kernel arm64 process context switching SCTLR_USER_MASK = include SCTLR_EL1_TCSO0_MASK
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems running on arm64 where Memory Tagging Extension (MTE) store-only tag checking can be enabled by a user task. The leaked setting can affect a different task after a context switch.
What must occur for the setting to leak between tasks?
A task must opt in to MTE store-only tag check mode, which sets SCTLR_EL1.TCSO0. A subsequent context switch can leave that setting enabled for another task because it was not included in the user SCTLR state cleared or restored during switching.
How can this be remediated?
Apply a Linux kernel update containing the fix that adds SCTLR_EL1_TCSO0_MASK to SCTLR_USER_MASK. The provided stable kernel references identify commits carrying the correction.