CVE-2026-90094 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
arm64: process: Fix context switching MTE store-only tag check
SCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLR_USER_MASK which imply that on context switch we never clear SCTLR_EL1.TCSO0, so we are leaking that setting into another task.
Fix that by including SCTLR_EL1_TCSO0_MASK into SCTLR_USER_MASK
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel for the arm64 architecture contains a critical flaw in its handling of Memory Tagging Extension (MTE) context switching, specifically regarding the store-only tag check mode. MTE is an ARM hardware feature designed to enhance memory safety by allowing software to attach tags to pointers and memory locations, enabling runtime detection of certain types of memory errors such as out-of-bounds accesses or use-after-free vulnerabilities. The architecture provides various modes for enforcing these checks, including a store-only mode where the processor verifies that stores are tagged correctly but does not check loads against their corresponding tags. This mode is controlled by the TCSO0 bit within the System Control Register EL1 (SCTLR_EL1). When a user-space application opts into this specific security posture, the kernel sets the SCTLR_EL1.TCSO0 flag to enable store-only tag checking for that process context.
The technical root of the vulnerability lies in how the kernel manages register state during task switches. The Linux kernel maintains a mask known as SCTLR_USER_MASK which defines which bits within SCTLR_EL1 are considered user-modifiable and thus need to be preserved or cleared appropriately when switching between different processes. However, the TCSO0 bit was inadvertently omitted from this mask. Consequently, when the scheduler transitions execution from one task to another, the kernel fails to clear the TCSO0 flag in the system control register for the incoming process. This oversight results in a state leakage scenario where the store-only tag check mode enabled by the previous task remains active and is inherited by the subsequent task without its explicit consent or configuration.
This improper context switching has significant operational implications for system security and stability. By leaking the MTE store-only setting, one process can inadvertently impose stricter memory safety constraints on another unrelated process. If the receiving application was not designed to operate under store-only tag checking rules, it may encounter unexpected faults when performing legitimate memory operations that do not align with the inherited tagging expectations. This can lead to application crashes or denial of service conditions for innocent processes sharing the same physical CPU core. Furthermore, in scenarios where security boundaries are critical, such as between a trusted sandbox and untrusted code, this leakage could potentially allow an attacker to manipulate the execution environment of another process by forcing specific MTE behaviors that might interfere with intended security controls or debugging mechanisms.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure, specifically involving the improper isolation of state between processes due to incomplete masking of control registers. It also relates to CWE-94: Improper Control of Generation of Code (Code Injection) in a broader sense if the leaked state causes unintended code execution paths or faults. In terms of MITRE ATT&CK techniques, this flaw could be leveraged as part of Defense Evasion by allowing an attacker to manipulate process behavior through side-channel-like effects on register states, although its primary impact is more aligned with Denial of Service and integrity violations rather than direct privilege escalation.
To mitigate this vulnerability, the Linux kernel developers have implemented a fix that explicitly includes the SCTLR_EL1_TCSO0_MASK within the SCTLR_USER_MASK definition for arm64 architectures. This ensures that during every context switch, the TCSO0 bit is properly cleared if it was not set by the incoming task's user-space configuration. System administrators and users should ensure their systems are updated with kernel patches that include this fix to prevent cross-process state leakage of MTE settings. For developers utilizing ARM64 hardware features, verifying that the operating system correctly isolates architectural control registers is essential for maintaining robust memory safety guarantees across multi-tenant or sandboxed environments.