A race exists between the release of a virtual LPI (Linear Physical Interrupt) and its re‑registration in the ARM64 KVM virtual GIC. When the reference count of an LPI reaches zero, the kernel removes the entry from the xarray and frees its memory. However, another CPU can concurrently add an LPI with the same INTID, causing the new entry to be inadvertently erased or the old entry to be overwritten. This race can lead to a use‑after‑free situation or memory corruption, potentially resulting in a kernel panic or denial of service within the virtual machine. Based on the description, it is inferred that this race involves concurrent CPUs manipulating the LPI xarray, and that an attacker must control guest LPI operations to trigger it. (CWE-821)

All Linux arm64 kernels that compile the KVM virtual GIC driver with LPI support are affected. The specific kernel versions lacking the fix are not listed, so any kernel compiled without the latest patch is vulnerable.

The condition is exploitable only inside a virtualized environment where an attacker controls a guest that can issue DISCARD or MAPTI operations. The flaw does not provide direct code execution but can be used to destabilize the guest, leading to crashes or, in certain circumstances, broader kernel instability. The CVSS score is 9.3, indicating critical severity, while the EPSS score is <1%, suggesting a very low probability of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must control guest operations such as DISCARD or MAPTI to trigger the race. The risk is considered moderate to high for environments that allow full guest control over LPI state.