Linux kernel arm64: LSE percpu ops on 8/16-bit types read and write 32 bits of memory

Impact

The arm64 percpu macros omit the size suffix when forming the LSE instruction, so a W register operand implies a 32-bit access and every 8-bit or 16-bit percpu operation touches four bytes instead of one or two. On any arm64 CPU with LSE atomics - which is every datacenter-class Arm part, including the Arm hosts in Grace and GH200/GB200 systems - this silently corrupts whatever percpu state sits next to the intended variable. The consequence is corrupted kernel per-CPU data with no attacker action required, which shows up as misbehaviour or crashes rather than as a clean fault. The record is a stable-tree correctness fix with no CVSS score and no exploitation detail; x86 nodes are not affected.

Who can reach it

Not an attacker-reachable interface - it is a miscompiled instruction sequence that fires during normal kernel operation on arm64 hosts built with LSE atomics. Exposure is the node itself, not a tenant or a network path.

What to do

On arm64 nodes, take the stable kernel update that appends the size suffix to the LSE instruction, then drain and reboot each node. x86_64 fleets need no action. The record names only the stable commits, not a fixed release version.

References

Related entries

• Linux kernel RDMA/core: iWARP port mapper initialises its refcount after publishing the requestCVE-2026-98252 · Linux kernel RDMA/core iWARP port mapper (iwpm_get_nlmsg_request refcount init)Unscored
• Linux kernel perf: NULL pmu dereference when a PMU module unloads with an event openCVE-2026-98268 · Linux kernel perf (is_include_guest_event / mediated PMU accounting)Unscored
• Linux kernel x86/kprobes: wrong return address when probing a CS-prefixed CALL crashes the hostCVE-2026-98273 · Linux kernel x86/kprobes (int3_emulate_call instruction length)Unscored
• powerpc/iommu: TCE IOBA range check ignores npages, allowing out-of-range table accessCVE-2026-98282 · Linux kernel powerpc/iommu (iommu_tce_check_ioba npages validation)Unscored
• KVM PPC Book3S HV: use-after-free on nested guest struct during all-LPID tlbie emulationCVE-2026-98283 · Linux kernel KVM PPC Book3S HV (kvmhv_emulate_tlbie_all_lpid)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical