{"id":"CVE-2026-90094","revision":"2c850892f9a64298b6ba030fe9d9c46a","records":[{"revision":"2c850892f9a64298b6ba030fe9d9c46a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90094","aliases":[],"title":"arm64: process: Fix context switching MTE store-only tag check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: process: Fix context switching MTE store-only tag check\n\nSCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check\nmode. However, it is not part of SCTLR_USER_MASK which imply that on\ncontext switch we never clear SCTLR_EL1.TCSO0, so we are leaking that\nsetting into another task.\n\nFix that by including SCTLR_EL1_TCSO0_MASK into SCTLR_USER_MASK","state":0,"publishedAt":"2026-09-17T16:06:07.494+00:00","modifiedAt":"2026-10-19T08:57:52.615+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/include/asm/processor.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4d51ff5bba00a13ca9b0b24883fa7adb07a167fc\",\n                            \"lessThan\": \"00a73ce437e27fdc636a5ede445a4a491e01788d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4d51ff5bba00a13ca9b0b24883fa7adb07a167fc\",\n                            \"lessThan\": \"2f10bc3ff24c91657887901c3235b803e5055f2b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4d51ff5bba00a13ca9b0b24883fa7adb07a167fc\",\n                            \"lessThan\": \"b8f070ac3167595069feb1f794c127b805115645\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm64/include/asm/processor.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/00a73ce437e27fdc636a5ede445a4a491e01788d","https://git.kernel.org/stable/c/2f10bc3ff24c91657887901c3235b803e5055f2b","https://git.kernel.org/stable/c/b8f070ac3167595069feb1f794c127b805115645"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90094","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90094","identifiers":["CVE-2026-90094"]},"retained":false,"historicalAffected":[]}],"coverage":[]}