CVE-2026-90094 arm64: process: Fix context switching MTE store-only tag check
A local attacker can leak Memory Tagging Extension settings between tasks due to improper context switching, potentially exposing sensitive memory state information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90094?
CVE-2026-90094 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
arm64: process: Fix context switching MTE store-only tag check
SCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLR_USER_MASK which imply that on context switch we never clear SCTLR_EL1.TCSO0, so we are leaking that setting into another task.
Fix that by including SCTLR_EL1_TCSO0_MASK into SCTLR_USER_MASK
Which versions are affected by CVE-2026-90094?
How do I fix CVE-2026-90094?
Apply the vendor's patch.
Is CVE-2026-90094 being exploited?
There is no known exploitation of CVE-2026-90094 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-90094, DEBIAN-CVE-2026-90094, GHSA-pj37-pf47-gwj8, UBUNTU-CVE-2026-90094.