The flaw arises in the Linux kernel’s KVM module for the LoongArch architecture, where the syscall kvm_vcpu_ioctl_interrupt() can be invoked from userspace without verifying the validity of the supplied IRQ number. This missing validation represents a weakness classified as CWE‑1287. An attacker could trigger arbitrary interrupts on a virtual CPU, potentially disrupting the guest operating system or, if privilege concerns arise, affecting host stability. The absence of validation could lead to denial of service or other unintended kernel behavior.

All builds of the Linux kernel that compile the KVM module for LoongArch hardware are potentially affected until the patch that adds IRQ validity checks is applied. No specific kernel version numbers are cited, so the vulnerability applies broadly to unpatched LoongArch KVM configurations.

The CVSS score of 8.8 classifies the weakness as high severity. The EPSS score of less than 1% indicates a low probability of exploitation as of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker would need a user‑level process on the host that has access to the KVM device; when kvm_vcpu_ioctl_interrupt() is invoked with an arbitrary IRQ number, the kernel may perform unintended actions, potentially leading to service disruption or kernel instability.