MTE As Implemented, Part 3: The Kernel

Notes on the first handset shipping with Arm Memory Tagging Extension (MTE) support, what the hardware mitigation means for memory-safety exploits, and early observations.

Part 1 of the MTE As Implemented series, testing real-world implementations of Arm Memory Tagging Extension to establish a correctness baseline for later mitigation analysis.

Part 2 of the MTE As Implemented series, presenting case studies of how Memory Tagging Extension mitigates real memory corruption exploits and where attackers might adapt.

The closing summary of the MTE As Implemented series, assessing how Arm Memory Tagging Extension behaves in real deployments and its practical effect on memory corruption exploitation.

An examination of how null pointer dereferences in the Linux kernel can be turned into exploitable primitives under modern configurations, with examples and mitigations.

This is a technical blog post about TLB flushing bugs in kernels, intended for people interested in kernel security and memory management.