CVE-2026-90094

A flaw was found in the Linux kernel, affecting the arm64 architecture's process context switching. When a user enables the Memory Tagging Extension (MTE) store-only tag check mode, the associated security setting (SCTLR_EL1.TCSO0) is not properly reset during a task switch. This oversight allows the MTE setting to be inadvertently exposed to another task. Such a leakage could potentially lead to unintended information disclosure or a bypass of security isolation mechanisms.

A flaw was found in the Linux kernel on the arm64 architecture, rated Moderate severity by Red Hat with a CVSS:3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). When a task enables the Memory Tagging Extension (MTE) store-only tag check mode, the SCTLR_EL1.TCSO0 register bit is set; however, because this bit is not included in SCTLR_USER_MASK, it is never cleared during a context switch. As a result, the store-only tag check setting leaks into the next task scheduled on the same CPU, which can undermine the intended memory-tagging isolation between processes on arm64 systems with MTE support, potentially leading to unintended information disclosure or a bypass of security isolation mechanisms. Exploiting this issue requires a local attacker with the ability to run tasks on an affected arm64 system. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 ship kernels containing this code and are affected, with fixes for the affected streams currently deferred as the issue is not considered urgent enough to warrant an immediate update; the residual risk is limited to local tasks on arm64 hardware with MTE that opt into store-only tag check mode. Red Hat Enterprise Linux 6, 7, 8, and 9, and OpenShift Container Platform releases are not affected because the vulnerable code is not present in the kernel versions they ship.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.