CVE-2026-98248

CVE-2026-98248

published October 6, 2026

CVSS
—
EPSS
0%
Percentile
9.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

arm64: percpu: Fix LSE operations on {8,16}-bit types

The assembly for __percpu_##name##_case_##sz() and

__percpu_##name##_return_case_##sz() doesn't use the 'sfx' macro

argument to form the LSE instruction. Without 'sfx', a W register

argument will imply a 32-bit memory location, and consequently

{8,16}-bit ops will erroneously read and write 32 bits of memory when

the LSE instruction is used.

Fix this by appending 'sfx' to 'op_lse' to LSE instruction. It is not

necessary (and not valid) to append 'sfx' to 'op_llsc', as 'op_llsc' is

a register-register operation which does not access memory (and does not

take a size suffix).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.3th percentile
Published
2026-10-06T13:18Z
References (4)
EPSS history
Timeline
  • 07 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 06 OCT 08:45Z
    arm64: percpu: Fix LSE operations on {8,16}-bit types
    cvelistv5