The flaw resides in the Linux kernel’s GICv3 interrupt controller driver for 32‑bit ARM systems compiled with CONFIG_ARM_LPAE. A physical address that can be up to 64 bits is stored in a 32‑bit unsigned long variable, causing the address to be truncated. When the driver allocates the ITS table with GFP_KERNEL, the truncated address leads the kernel to request memory that lies outside the valid range, resulting in a crash of the system during boot or while running a virtio‑based guest. This integer‑truncation defect directly compromises system stability and permits an attacker to cause a denial of service by simply rebooting or running the affected kernel.

The issue is present in Linux kernel 6.19 release‑candidate releases 1 through 6 and in any other builds compiled with CONFIG_ARM_LPAE on 32‑bit ARM hardware. CPE entries for the kernel include the generic Linux kernel and the 6.19 rc1‑rc6 builds. The vulnerability is triggered when the GICv3 ITS driver is initialized, such as in machines or devices that rely on virtio guest support.

The CVSS score of 5.5 reflects a moderate severity, while the EPSS score of less than 1 % indicates a very low likelihood of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the system to boot with the vulnerable kernel, so it is likely limited to a privileged user or an attacker who can replace the kernel image. Given the low exploitation probability and the absence of active exploitation, the overall risk remains moderate but mitigation is recommended.