MTE As Implemented, Part 1: Implementation Testing
Summary: Project Zero tested pre-production ARM v8.5a hardware implementing Memory Tagging Extensions through mid-2022 and early 2023, using manually tagged statically-linked binaries to assess whether MTE can support security mitigations or only debugging. The team found no additional speculative side-channel that would leak tag-check success or failure, but identified software-side issues, including that the Linux kernel does not catch invalid accesses to userspace pointers during system calls, leaving async-MTE a likely soft mitigation.
What's compelling: The finding that async-MTE can be limited to a soft mitigation regardless of tagging strategy means a security leader cannot treat MTE as a hard boundary against memory corruption, and the documented kernel gap for incorrectly tagged userspace pointers during system calls is a concrete coverage hole to account for.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026