A race condition exists in the Linux KVM arm64 Virtual Generic Interrupt Controller (VGIC) implementation. If an interrupt remains pending in one virtual CPU’s pending list while another virtual CPU disables the same LPI and a third virtual CPU migrates the interrupt, the VGIC may drop lock protection, release the interrupt reference, and subsequently free the interrupt object. The next operation then dereferences a freed object, resulting in a use‑after‑free exploit. This flaw aligns with CWE-364 (Race Condition).

All versions of the Linux kernel that contain the arm64 KVM VGIC code prior to the patch commit (c/7258770e5814f15e8308ebda82ac9acf6964ba8e) are affected. Systems running KVM guests on ARM64 hardware, where the kernel’s VGIC implementation is in use, are at risk.

The CVSS score of 9.3 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The CVE is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires precise timing across three virtual CPUs and hypervisor‑level control, implying that only an attacker with root or hypervisor privileges could orchestrate the required race. The likely attack vector is a coordinated race between vCPU threads inside a privileged hypervisor. If successful, the use‑after‑free could lead to arbitrary code execution in the kernel or a denial‑of‑service through a kernel crash.