The fault stems from the Linux kernel’s KVM arm64 code that initializes the virtual Generic Interrupt Controller (VGIC) distribution domain. If the helper function `vgic_allocate_private_irqs_locked()` fails, the main creation routine exits early and leaves the region descriptors (`dist->rd_regions`) uninitialized. When the VGIC teardown routine later runs, it attempts to free these uninitialized regions, which can cause a kernel panic or crash. Based on the description, it is inferred that successful exploitation of this flaw would result in a denial‑of‑service condition on the host or virtual machine rather than remote code execution or privilege escalation.

The problem exists in all Linux kernel releases for arm64 that contain the unpatched KVM VGIC initialization code. It affects hosts running KVM with the VGIC feature enabled. No specific vendor or distribution versions are listed beyond the generic Linux kernel, so any distribution that relies on the upstream kernel source for arm64 hosts is potentially vulnerable until the corrective commit is incorporated.

The CVSS score of 5.5 indicates moderate severity. No publicly documented exploits are available, and the EPSS score is not provided. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require privileged access to the host to trigger VM creation or destruction that paths through the failing code path, so the most likely attack vector is local privileged. The overall risk is medium for systems that frequently spin up KVM guests on arm64 hardware, because a crash could affect the entire host.