The vulnerability involves the Linux kernel's KVM arm64 implementation of the virtual generic interrupt controller (VGIC) peripheral‑ITS translation cache. During cache invalidation, the code drops a reference to an entry using the iterator pointer instead of the previously erased value. When multiple concurrent contexts invalidate the same entry, the reference may be dropped more than once, leading to a double‑free. The resulting kernel use‑after‑free can corrupt memory or trigger a crash, leading to denial of service. The CVE description does not claim arbitrary code execution; it only highlights potential kernel instability.

The flaw resides in the Linux kernel, affecting all distributions that ship the unpatched arm64 KVM VGIC ITS code. The available CPE identifier indicates the kernel as the affected component, but no specific version range is provided in the CNA data. Users should verify whether their kernel includes the commit that fixes the reference‑dropping logic.

Open source kernel code, the CVSS score of 9.3 reflects critical severity. The EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, involves concurrent ITS cache invalidation contexts – such as ITS command handlers, GITS_CTLR write paths, or GICR_CTLR paths – that can trigger the double‑free. If these contexts are reachable, the bug could lead to a kernel crash, causing denial of service.