Riskcovery

CVE-2026-90094

arm64: process: Fix context switching MTE store-only tag check

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: process: Fix context switching MTE store-only tag check

SCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLR_USER_MASK which imply that on context switch we never clear SCTLR_EL1.TCSO0, so we are leaking that setting into another task.

Fix that by including SCTLR_EL1_TCSO0_MASK into SCTLR_USER_MASK

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 4d51ff5bba00a13ca9b0b24883fa7adb07a167fc to before 00a73ce437e27fdc636a5ede445a4a491e01788dAffected
  • 4d51ff5bba00a13ca9b0b24883fa7adb07a167fc to before 2f10bc3ff24c91657887901c3235b803e5055f2bAffected
  • 4d51ff5bba00a13ca9b0b24883fa7adb07a167fc to before b8f070ac3167595069feb1f794c127b805115645Affected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.