HIGH Introduced in 7.0
irqchip LogicalIndex OOB
CVE-2026-90120
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing In gic_acpi_parse_iaffid() a given MADT GICC entry might not correspond to a logical cpu recognized by the kernel, resulting in the cpu variable initialization to an error value. Currently, the get_logical_index() return value is not checked for failure, which might result in out-of-bounds memory corruption while trying to index a per_cpu variable array. Add a check to evaluate get_logical_index() return value.
02KernelScan AI Analysis
Risk summary
The GIC v5 interrupt controller driver fails to validate a CPU index lookup result during boot-time ACPI table parsing, allowing an invalid negative value to be used as an array index into per-CPU data, causing out-of-bounds memory corruption. Exploitation requires either physical access to modify firmware ACPI tables or root-level access to alter boot configuration on ARM64 systems with GIC v5 and ACPI.
Vulnerability analysis
The GIC v5 interrupt controller driver parses ACPI firmware tables during boot to map hardware processor identifiers to kernel-internal CPU indices. When a table entry describes a processor the kernel does not recognize, the lookup returns an error code, but the original code uses this value directly as an index into a per-CPU data array without checking for failure, causing out-of-bounds memory corruption. The fix adds a validation check that silently skips unrecognized processor entries instead of indexing the array with the invalid value. This vulnerability is reachable only during boot-time ACPI table parsing on ARM64 systems equipped with a GIC v5 interrupt controller, and requires either physical access to modify firmware tables or root-level access to alter the boot configuration.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.6 | 6caeb878f809 |
| mainline | 7.0 | 7.3-rc1 | 328affc639ce |