The Linux kernel for LoongArch implements a KVM IRQ routing mechanism that lacks a bounds check on the irqchip index supplied by the host. Without validation, an attacker can supply an out‑of‑range index that causes the kernel to read or write past the routing table’s chip array. This can lead to memory corruption or a kernel crash. This scenario is an instance of improper validation of array index (CWE-823).

Any system running a Linux kernel on a LoongArch processor with KVM enabled is affected until the patch is applied. The advisory does not list specific kernel versions, so users of all supported LoongArch kernel releases should verify whether the validation commit is present. Systems that do not employ KVM or disable irqfd routing are not impacted.

The CVSS score of 8.8 classifies the issue as high severity. The EPSS of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability resides in privileged kernel code, so if an attacker can supply a crafted irqfd routing request— the likely attack vector inferred from the description— they could potentially corrupt kernel data or cause a denial of service. The flaw is not yet listed in the CISA KEV catalog, and no public exploits are documented.