{"id":"CVE-2026-90094","summary":"arm64: process: Fix context switching MTE store-only tag check","details":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: process: Fix context switching MTE store-only tag check\n\nSCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check\nmode. However, it is not part of SCTLR_USER_MASK which imply that on\ncontext switch we never clear SCTLR_EL1.TCSO0, so we are leaking that\nsetting into another task.\n\nFix that by including SCTLR_EL1_TCSO0_MASK into SCTLR_USER_MASK","modified":"2026-09-19T03:47:30.925331786Z","published":"2026-09-17T16:06:07.494Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90094.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/00a73ce437e27fdc636a5ede445a4a491e01788d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2f10bc3ff24c91657887901c3235b803e5055f2b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b8f070ac3167595069feb1f794c127b805115645"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90094.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90094"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4d51ff5bba00a13ca9b0b24883fa7adb07a167fc"},{"fixed":"00a73ce437e27fdc636a5ede445a4a491e01788d"},{"fixed":"2f10bc3ff24c91657887901c3235b803e5055f2b"},{"fixed":"b8f070ac3167595069feb1f794c127b805115645"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90094.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.17.0"},{"fixed":"6.18.52"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90094.json"}}],"schema_version":"1.9.0"}