The vulnerability occurs in the Linux kernel’s virtual GIC ITS driver when a userspace utility restores a Device Table Entry (DTE) that encodes more EventID bits than the virtual ITS supports. The restoration routine accepts the out‑of‑range value and stores it in the device structure without performing the same range check that the live MAPD path uses. Subsequent code converts this unchecked value into an oversized scan range, which can overflow a kernel buffer. The flaw is a classic buffer overflow (CWE‑805) that can lead to kernel memory corruption, system crash, or potentially arbitrary code execution if sufficient control is achieved.

Any system running the Linux kernel that contains the vgic‑its driver for KVM on ARM64 is affected. The issue applies to all kernel versions that include the current vgic‑its source code without the patch, regardless of compilation time or distribution. Because the driver is compiled into the core kernel, the fix is delivered via kernel updates.

The CVSS score of 9.0 indicates a high‑impact vulnerability. The EPSS score is reported as less than 1 %, implying a low current exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The likely attack path requires an attacker to invoke the restoration routine, which typically demands privileged KVM access or control over a virtual machine that can supply malicious DTE state. Since the flaw involves an unchecked kernel buffer, successful exploitation could result in memory corruption or denial of service, although code execution would require additional conditions.