The vulnerability exists in the LoongArch implementation of the Linux kernel’s KVM hypervisor. The function kvm_get_vcpu_by_cpuid() accepts a signed integer cpuid argument, and a negative value causes the routine to index the phyid_map::phys_map[] array outside its bounds. This out‑of‑bounds access can trigger a kernel panic or expose sensitive kernel memory, resulting in a denial of service or information leakage for a local attacker.

The flaw affects Linux kernel releases 6.10 and all 7.0 release candidates (rc1 through rc7). It is present in the standard Linux kernel distribution and therefore impacts any system running one of those kernel versions, regardless of vendor. The CPE identifier confirms its reach across all Linux kernel builds.

The CVSS score of 8.8 indicates a high severity. With an EPSS score of less than 1%, the current data suggests a very low exploitation probability under normal conditions. The weakness is not listed in CISA’s KEV catalog. Exploitation would require local kernel access or control over a virtual machine executing KVM, implying a privileged or sophisticated adversary. The attack vector is likely local or confined to virtual machine guests, and no externally public exploits are documented at this time.