The Linux kernel contains a flaw in the KVM arm64 vgic module where the reference count is not correctly incremented for IRQs stored in the last_lr_irq field. If an LPI is concurrently unmapped while the IRQ is referenced, the interrupt may disappear and the module may attempt to use a released resource. This can lead to kernel crashes or other unstable behavior, potentially allowing an attacker to cause a denial of service or compromise system integrity. The fix involves bumping the refcount when populating last_lr_irq and dropping it during vgic_prune_ap_list().

Systems running the Linux kernel on arm64 that use KVM virtualization and enable the vgic interrupt controller are affected. This includes any host running the kernel with the vgic module active, regardless of distribution or vendor, as the vulnerability is part of the core KVM code.

The vulnerability can be exploited by an adversary with sufficient privileges or when an untrusted guest can trigger LPI unmapping during host operation. The CVSS score is 6.5, indicating a medium severity. The EPSS score is 0.00155, indicating a very low exploitation probability, and the issue is not listed in CISA’s KEV catalog. The severity should be treated as high due to the potential for kernel panic. The lack of an official workaround means patching is required; the attack vector is local to the host kernel, most likely via privileged users or compromised guests. The risk is compounded by the lack of detection mechanisms; therefore, mitigation should be applied promptly.