« Volver al listado

CVE-2026-90094

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

arm64: process: Fix context switching MTE store-only tag check

SCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLR_USER_MASK which imply that on context switch we never clear SCTLR_EL1.TCSO0, so we are leaking that setting into another task.

Fix that by including SCTLR_EL1_TCSO0_MASK into SCTLR_USER_MASK

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90094",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4d51ff5bba00a13ca9b0b24883fa7adb07a167fc",
              "lessThan": "00a73ce437e27fdc636a5ede445a4a491e01788d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4d51ff5bba00a13ca9b0b24883fa7adb07a167fc",
              "lessThan": "2f10bc3ff24c91657887901c3235b803e5055f2b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4d51ff5bba00a13ca9b0b24883fa7adb07a167fc",
              "lessThan": "b8f070ac3167595069feb1f794c127b805115645",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/arm64/include/asm/processor.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/arm64/include/asm/processor.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:01.020",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/00a73ce437e27fdc636a5ede445a4a491e01788d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2f10bc3ff24c91657887901c3235b803e5055f2b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b8f070ac3167595069feb1f794c127b805115645",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: process: Fix context switching MTE store-only tag check\n\nSCTLR_EL1.TCSO0 is set when user opt-in for MTE store-only tag check\nmode. However, it is not part of SCTLR_USER_MASK which imply that on\ncontext switch we never clear SCTLR_EL1.TCSO0, so we are leaking that\nsetting into another task.\n\nFix that by including SCTLR_EL1_TCSO0_MASK into SCTLR_USER_MASK"
    }
  ],
  "lastModified": "2026-09-17T17:17:01.020",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}