The vulnerability occurs in the Linux kernel’s virtual GIC ITS driver when a userspace utility restores an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS can handle. The restore routine vgic_its_restore_dte() accepts this out‑of‑range value and stores it in the device structure without performing the range check that the live MAPD path uses. Subsequent code converts this unchecked value into an oversized scan_its_table() range. The flaw leaves an unvalidated kernel structure field that can be manipulated by authorized userspace restores, potentially causing unbounded scanning behavior in the kernel.

Any system running a Linux kernel that includes the vgic‑its driver for KVM on ARM64 is affected. The issue applies to all kernel versions that contain the current vgic‑its source code without the patch, regardless of compilation time or distribution. Because the driver is compiled into the core kernel, the fix is delivered via kernel updates.

The CVSS score of 9.0 indicates a high‑impact vulnerability. The EPSS score is reported as less than 1 %, implying a low current exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The likely attack path requires an attacker to invoke the restoration routine, which typically demands privileged KVM access or control over a virtual machine that can supply malicious DTE state. Since the flaw exposes an unchecked kernel buffer field, successful exploitation could result in kernel instability or denial of service, although code execution is not explicitly documented.