CVE-2026-98248: arm64: percpu: Fix LSE operations on {8,16}-bit types
arm64: percpu: Fix LSE operations on {8,16}-bit types
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Append 'sfx' to 'op_lse' when forming the LSE instruction in __percpu_##name##_case_##sz() and __percpu_##name##_return_case_##sz(); do not append it to 'op_llsc'.
Linux kernel arm64 percpu LSE operations op_lse instruction formation = append 'sfx'
Event History
Frequently Asked Questions
Which systems are exposed to the erroneous memory accesses?
The issue affects arm64 Linux kernel environments when LSE instructions are used for 8-bit or 16-bit per-CPU operations. In that condition, the operations can read and write 32-bit memory locations instead of the intended smaller locations.
What is the relevant configuration or execution condition?
The faulty behavior is specific to the LSE instruction path. The LL/SC path is not described as affected, because it uses register-register operations and does not access memory with a size suffix.
How can I check whether the fix is present in kernel source?
Check whether the LSE operation mnemonic is formed by appending the sfx macro argument to op_lse for the affected per-CPU operation macros. The correction should not append sfx to op_llsc.