CVE-2026-90094

CVE-2026-90094 affects the Linux kernel on arm64 systems, specifically in the process context-switching path for MTE (Memory Tagging Extension) store-only tag check mode. When a user opts in to store-only tag check via SCTLR_EL1.TCSO0 , that flag was not included in SCTLR_USER_MASK , meaning it w...

CVE-2026-90094 arm64: process: Fix context switching MTE store-only tag check

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

PT-2026-94686

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the amba-pl011 serial driver where the pl011 console write atomic function is called from an atomic context that prohibits sleeping. The function invokes clk enable,...

PT-2026-94696

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An alignment fault occurs in the Linux kernel when processing MSA ramdumps on WCN3990/SNOC devices using arm64 architecture. The ath10k msa dump memory function utilizes a plain memcpy t...

PT-2026-94695

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture during syscall entry tracing. A tracer can manipulate the first syscall argument, which may allow it to bypass seccomp or audit checking. This...

PT-2026-94442

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture regarding the Memory Tagging Extension MTE store-only tag check mode. When a user opts into this mode, the SCTLR EL1.TCSO0 bit is set. Because...

CVE-2026-93135: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

CVE-2026-90347: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

CVE-2026-90348: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...

CVE-2026-90212: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

CVE-2026-90094: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

PT-2026-94931

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier skips rewriting the helper call offset insn-imm in bpf do misc fixups for architectures that implement bpf...

CVE-2026-90201: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix UAF in pagepoolreleasenetmemdma on xacmpxchg race This bug was discovered while testing the hns3 driver under channel reconfiguration ethtool -L / ethtool -G with iperf3 traffic on arm64. The race is...

CVE-2026-90290: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error Sashiko AI has reported that if swsuspmtesavetags for some reason fails we return from swsusparchsuspend with DAIF being masked - that is not what we'd expect. Restore the saved DAIF...

PT-2026-94560

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 EFI implementation where a bad kernel memory access can occur on machines supporting EFI runtime services when using software PAN CONFIG ARM64 SW TTBR0 PAN=y...

PT-2026-94638

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture during hibernation where the DAIF Driver, Asynchronous abort, IRQ, and FIQ state is not properly restored upon an error. Specifically, if the...

CVE-2026-89912

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for ARM64 architecture, specifically within the vgic-its component. A malicious guest virtual machine could trigger a null pointer dereference on the host system during a migration save operation. This could lead to a denial ...

CVE-2026-89775

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for arm64 systems. This issue arises when the system's Memory Management Unit MMU is inactive, causing an internal calculation for memory translation buffers TLB to misinterpret a negative value. This leads to an incorrect...

SUSE CVE-2026-89775

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappings such as VNCR, this is deducted from...

CVE-2026-89981

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMIDEL1 when MTE is disabled cpuinfostorecpu gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE CONFIGARM64MTE=n or arm64.nomte. KVM sets HCREL2.TID5 ...