Executive brief
The Linux kernel's GIC-v5 interrupt controller driver contains a logic error in ACPI MADT table parsing that can cause out-of-bounds memory corruption. When processing CPU entries in the MADT table, the code fails to validate that a CPU ID exists before indexing system memory structures, potentially allowing local code to trigger memory corruption and system instability.
Technical details
The vulnerability is an unchecked return value leading to out-of-bounds array access in the gic_acpi_parse_iaffid() function within drivers/irqchip/irq-gic-v5-irs.c. The get_logical_index() function can return a negative error code when a MADT GICC entry does not correspond to a logical CPU recognized by the kernel, but this return value was never checked before being used to index per_cpu variable arrays. This results in out-of-bounds memory corruption. The fix adds a simple check: if get_logical_index() returns a negative value, the function returns early. The vulnerability affects ACPI-based systems with GIC-v5 interrupt controllers and requires local code execution to trigger. The patch was committed in August 2026.
Affected products
- Linux Linux kernel Linux 5.10 and later through 6.x (exact range unclear from advisory)
Timeline
- 2026-09-17: disclosed: CVE-2026-90120 published
- 2026-08-20: patched: Fix committed by Thomas Gleixner (commit 328affc639ce9873a7a0a3fd6b8339f19767529b)