The vulnerability occurs in the arm64 Virtual Generic Interrupt Controller (VGIC) implementation of the Linux kernel. When migrating an interrupt between virtual CPUs, the code releases both the interrupt list lock (ap_list_lock) and the IRQ lock (irq_lock) before reacquiring them. It then only verifies that the interrupt’s affinity remains unchanged (target_vcpu == vgic_target_oracle(irq)) before performing the list removal. If, while the locks are released, the interrupt is taken off the pending list by vgic_flush_pending_lpis(), the subsequent affinity check passes even though the interrupt has already been removed. A second list_del() call on an already removed entry corrupts kernel memory, which can lead to a kernel panic and bring the host down.

Linux kernel builds that run the KVM hypervisor on ARM‑64 architectures and that include the unpatched VGIC code are vulnerable. All such kernels lacking the repository commit that introduces the missing reassignment check are affected; no specific vendor or version range is indicated, so the risk applies broadly to all older or custom arm64 builds not containing the fix.

The flaw is a race condition that can corrupt kernel memory, leading to a high CVSS score of 9.3. The EPSS score of < 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a malicious guest virtual machine that manipulates interrupt state to trigger the race; this inference is based on the KVM exposure of interrupt handling to guest code. Successful exploitation would cause a host crash; if an attacker can control additional kernel execution they might elevate privileges, though no public exploit is known.