UBUNTU-CVE-2026-90094: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear SCTLREL1.TCSO0, so we are leaking that setting into another task. Fix that by including SCTLREL1TCSO0MASK into SCTLRUSERMASK
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Include SCTLR_EL1_TCSO0_MASK in SCTLR_USER_MASK so SCTLR_EL1.TCSO0 is cleared during context switches.
Linux kernel arm64 process context switching SCTLR_USER_MASK = include SCTLR_EL1_TCSO0_MASK
Event History
Frequently Asked Questions
What conditions are required for the setting to leak between tasks?
A user task must opt in to MTE store-only tag checking, which sets SCTLR_EL1.TCSO0. When that task is context-switched out, the kernel can fail to clear the setting before another task runs.
Which systems are relevant to this issue?
The flaw is in the arm64 context-switching path and concerns Memory Tagging Extension store-only tag checking. Systems and workloads that do not use arm64 MTE store-only mode are not described as triggering the affected setting.