---
id: CVE-2026-90094
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: process: Fix context switching MTE store-only tag check

  SCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check
  mode
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  arm64: process: Fix context switching MTE store-only tag check

  SCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check
  mode. However, it is not part of SC…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4d51ff5bba00a13ca9b0b24883fa7adb07a167fc <
    00a73ce437e27fdc636a5ede445a4a491e01788d
  - >-
    Linux >= 4d51ff5bba00a13ca9b0b24883fa7adb07a167fc <
    2f10bc3ff24c91657887901c3235b803e5055f2b
  - >-
    Linux >= 4d51ff5bba00a13ca9b0b24883fa7adb07a167fc <
    b8f070ac3167595069feb1f794c127b805115645
  - Linux 6.17
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:01.020'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90094'
references:
  - url: 'https://git.kernel.org/stable/c/00a73ce437e27fdc636a5ede445a4a491e01788d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2f10bc3ff24c91657887901c3235b803e5055f2b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b8f070ac3167595069feb1f794c127b805115645'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.891Z'
epss: 0.00206
epssPercentile: 0.09533
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

arm64: process: Fix context switching MTE store-only tag check

SCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check
mode. However, it is not part of SCTLR_USER_MASK which imply that on
context switch we never clear SCTLR_EL1.TCSO0, so we are leaking that
setting into another task.

Fix that by including SCTLR_EL1_TCSO0_MASK into SCTLR_USER_MASK

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.