The bug centers on the handling of the virtual generic interrupt controller (VGIC) per-ITS translation cache in the Linux kernel’s KVM arm64 implementation. During cache invalidation, the code drops a reference to an entry but mistakenly uses the pointer returned by the iterator rather than the actual erased value. When multiple concurrent contexts perform invalidation, the same cache entry can be erased and subsequently dropped more than once, allowing the entry to be freed while other components still refer to it. This double‑free scenario can lead to a kernel use‑after‑free condition, providing an attacker the opportunity to execute arbitrary code at elevated privilege or to crash the kernel, resulting in a denial of service. The vulnerability can be exploited via any path that triggers concurrent ITS invalidations, notably from ITS command handlers, GITS_CTLR write operations, or redistributor’s GICR_CTLR paths.

The flaw resides in the Linux kernel, affecting all distributions that ship the unpatched arm64 KVM VGIC ITS code. The available CPE identifier indicates the kernel as the affected component, but no specific version range is provided in the CNA data. Users should verify whether their kernel includes the commit that fixes the reference‑dropping logic.

Because the bug concerns kernel memory management and can be triggered by concurrent paths that may be invoked by privileged users or potentially by user applications that interact with KVM, the exploitability is significant for systems that permit such operations. The CVSS score of 7.0 indicates a high severity, consistent with similar use‑after‑free or double‑free vulnerabilities. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the presence of an identified kernel race condition warrants immediate attention from administrators who run KVM on arm64 platforms.