In the LoongArch KVM implementation of the Linux kernel, the base address for a register in kvm_eiointc_regs_access() is calculated incorrectly. The function adds an offset directly to a 64‑bit base address value instead of first converting the base address to a pointer type, resulting in a type misuse categorized as CWE‑681. This incorrect calculation can lead to the use of out‑of‑bounds memory addresses, potentially corrupting kernel memory and causing instability such as kernel panics.

The flaw affects the Linux kernel across versions 6.19 and all 7.0 release candidates up to and including 7.0‑rc7 when running on LoongArch hardware with the KVM hypervisor. Users running these kernel releases on affected systems are impacted until the code path is removed by the patch.

With a CVSS score of 5.5 the vulnerability is of moderate severity. The EPSS score is below 1 %, indicating a low likelihood of exploitation at present, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploiting the bug would require access to the vulnerable KVM subsystem and the ability to influence the address calculation, implying a local or privileged context rather than a wide‑range remote attack vector. The primary risk remains kernel memory corruption and potential system instability.