The flaw involves the KVM arm64 Virtual Generic Interrupt Controller (vGIC) subsystem, where private IRQs allocated during vCPU initialization are not freed if the redistributor registration fails, constituting a CWE-772 (Missing Release of Resource after Allocation) weakness. This missing cleanup triggers a resource leak that can deplete the pool of available private interrupts. While the leakage itself does not provide direct lateral or remote access, sustained failures may compromise system stability and availability, especially in high‑density virtualized environments.

Linux kernel implementations that support KVM on ARM64 architectures are affected; versions that do not contain the fix for the missing kvm_vgic_vcpu_destroy() call on the kvm_vgic_vcpu_init() failure path are vulnerable. Specific affected version information is not supplied in the CVE data. Impacted systems are those running KVM hypervisors on ARM64 hosts.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1%, showing a very low probability that the exploit is actively used. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local kernel access or privileged control over the KVM host to trigger the faulting path; it does not exploit a user‑level component or provide remote connectivity on its own.