The vulnerability resides in the Linux kernel’s GICv3 interrupt controller driver on 32‑bit ARM systems compiled with CONFIG_ARM_LPAE. A physical address that can be up to 64 bits is mistakenly stored in a 32‑bit unsigned long, resulting in address truncation. When the ITS table is allocated with GFP_KERNEL, the truncated address causes the kernel to request memory outside the valid range, leading to a crash during boot or while a virtio‑based guest is running. This defect directly compromises system stability, providing a straightforward denial‑of‑service path. The flaw arises from incorrect handling of numerical values and is associated with CWE‑190.

The flaw affects Linux kernel 6.19 release‑candidate builds 1 through 6 and any other 32‑bit ARM kernel compiled with CONFIG_ARM_LPAE. The CPE entries list the generic Linux kernel and the specific 6.19 rc1–rc6 builds. Systems that enable the GICv3 ITS driver, such as those running virtio guests, are impacted.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of < 1 % points to a very low likelihood of real‑world exploitation. The vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker rebooting or otherwise booting the system with the vulnerable kernel; this suggests that a privileged user or an attacker able to replace the kernel image would be required. Because exploitation depends on the system booting the affected kernel, the risk remains moderate, and mitigation is recommended.