CVE-2026-98248

Summary

In the Linux kernel, the following vulnerability has been resolved:

arm64: percpu: Fix LSE operations on {8,16}-bit types

The assembly for _percpu##name##case##sz() and _percpu##name##return_case##sz() doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a 32-bit memory location, and consequently {8,16}-bit ops will erroneously read and write 32 bits of memory when the LSE instruction is used.

Fix this by appending 'sfx' to 'op_lse' to LSE instruction. It is not necessary (and not valid) to append 'sfx' to 'op_llsc', as 'op_llsc' is a register-register operation which does not access memory (and does not take a size suffix).

Affected Software

VendorProductVersion RangeStatus
LinuxLinux959bf2fd03b59fc107584c21425f3dc73c49f762 < d69ab4480e49bf925f4781afcc9f284affcb96b6affected
LinuxLinux959bf2fd03b59fc107584c21425f3dc73c49f762 < 390742871a723b52de9b92a94c0d1c85a2531e3eaffected
LinuxLinux959bf2fd03b59fc107584c21425f3dc73c49f762 < 843ace1d0a39e9b1cfcbfb3856a7b0fbdd9cd003affected
LinuxLinux959bf2fd03b59fc107584c21425f3dc73c49f762 < 8cf2093f5372952a9ebc805c418d45df7112cd14affected
LinuxLinux5.0affected
LinuxLinux0 < 5.0unaffected
LinuxLinux6.12.112 <= 6.12.*unaffected
LinuxLinux6.18.54 <= 6.18.*unaffected
LinuxLinux7.2.8 <= 7.2.*unaffected
LinuxLinux7.3-rc4 <= *unaffected

Weaknesses

References