CVE-2026-98248 PUBLISHED

arm64: percpu: Fix LSE operations on {8,16}-bit types

Assigner: Linux
Reserved: 25.09.2026 Published: 06.10.2026 Updated: 06.10.2026

In the Linux kernel, the following vulnerability has been resolved:

arm64: percpu: Fix LSE operations on {8,16}-bit types

The assembly for __percpu_##name##case##sz() and __percpu_##name##return_case##sz() doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a 32-bit memory location, and consequently {8,16}-bit ops will erroneously read and write 32 bits of memory when the LSE instruction is used.

Fix this by appending 'sfx' to 'op_lse' to LSE instruction. It is not necessary (and not valid) to append 'sfx' to 'op_llsc', as 'op_llsc' is a register-register operation which does not access memory (and does not take a size suffix).

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 959bf2fd03b59fc107584c21425f3dc73c49f762 to d69ab4480e49bf925f4781afcc9f284affcb96b6 (excl.)
  • affected from 959bf2fd03b59fc107584c21425f3dc73c49f762 to 390742871a723b52de9b92a94c0d1c85a2531e3e (excl.)
  • affected from 959bf2fd03b59fc107584c21425f3dc73c49f762 to 843ace1d0a39e9b1cfcbfb3856a7b0fbdd9cd003 (excl.)
  • affected from 959bf2fd03b59fc107584c21425f3dc73c49f762 to 8cf2093f5372952a9ebc805c418d45df7112cd14 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.0 is affected
  • unaffected from 0 to 5.0 (excl.)
  • unaffected from 6.12.112 to 6.12.* (incl.)
  • unaffected from 6.18.54 to 6.18.* (incl.)
  • unaffected from 7.2.8 to 7.2.* (incl.)
  • unaffected from 7.3-rc4 to * (incl.)

References