The flaw resides in the Linux kernel’s virtual GIC ITS driver for ARM64. When userspace restores a Device Table Entry, the restore routine accepts a size field that encodes more EventID bits than the virtual ITS supports, storing the out‑of‑range value in dev->num_eventid_bits without the range check performed by the live MAPD path. This unchecked kernel state can later be used to construct an oversized scan range, which may cause the kernel to attempt an out‑of‑bounds memory scan and crash, resulting in a denial of service. The underlying weaknesses are input validation failure (CWE‑20) and integer overflow (CWE‑805).

Any Linux system that compiles the vgic‑its driver for KVM on ARM64 and has not applied the recent kernel patch is potentially affected. The vulnerability applies to the core kernel in all distributions that ship the unpatched source, including older kernel releases and custom builds. Precise affected versions are not enumerated in the CVE, but any kernel containing the v4git commit referenced in the advisory before the patch is vulnerable.

The CVSS score of 9.0 indicates a critical impact. The EPSS score is less than 1 %, suggesting a very low current exploitation probability. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack must involve invoking the restore routine, which requires privileged KVM access or the ability for a guest to supply malicious DTE state; this requirement is inferred from the description. If an attacker can supply such state, the unchecked value could cause kernel instability or a crash, but the Advisory does not document code execution or persistent compromise. Overall, the risk is high if the system can be exposed to malicious userspace restoration attempts.