CVE-2026-98248

The flaw resides in the assembly for per-CPU LSE (local store-exclusive) operations on 8- and 16-bit data on arm64 cores. By omitting the size suffix, the generated LSE instruction treats the operand as 32 bits, causing the kernel to read and write four bytes where only one or two bytes were intended. This mis‑encapsulation leads to overwriting unrelated kernel memory and results in a buffer overflow. While the description does not explicitly claim a privilege escalation path, kernel data corruption can enable attackers to manipulate kernel structures, potentially escalating privileges if they can control the corrupted data.

All arm64 Linux kernel that lack commit 390742871a723b52de9b92a94c0d1c85a2531e3e are affected. This includes every arm64 kernel version in which the per-CPU LSE implementation uses the incorrect assembly before the patch, regardless of distribution or vendor.

The CVSS score of 5.5 and the EPSS score of <1% indicate a medium severity with a very low probability of exploitation. The vulnerability is not in the CISA KEV catalog. Because the flaw is only exploitable from kernel mode and requires the attacker to trigger specific LSE operations, the likelihood of a practical exploitation scenario is low. However, the potential impact of kernel memory corruption is significant, making any successful exploitation likely to compromise system integrity and possibly elevation of privileges.