Executive brief
The Linux kernel's ARM64 processor context switching code failed to properly clear Memory Tagging Extension (MTE) store-only tag check settings when switching between user tasks. This caused security-sensitive configuration from one task to persist and affect another task, potentially weakening memory protection for applications that did not opt into store-only tag checking.
Technical details
The vulnerability is a configuration leakage during process context switching in ARM64 architecture. The SCTLR_EL1.TCSO0 (System Control Register store-only tag check bit) was not included in SCTLR_USER_MASK, which defines which control register bits are cleared on context switch. When a user task enabled MTE store-only tag check mode by setting TCSO0, this setting was never cleared during context switch, causing it to leak into the control register state of the next task. The fix adds SCTLR_EL1_TCSO0_MASK to SCTLR_USER_MASK, ensuring the bit is properly reset during task switching. This affects ARM64 systems running the Linux kernel with MTE support enabled.
Affected products
- Linux Linux kernel Multiple kernel versions (fix backported to stable branches 4.14.y, 4.19.y, 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y and others)
Timeline
- 2026-09-17: disclosed
- 2026-08-19: patched: Upstream commit b8f070ac3167595069feb1f794c127b805115645 authored; backported to stable kernels on 2026-09-14