{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-90120",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-09-11T19:38:34.787Z",
        "datePublished": "2026-09-17T16:06:24.607Z",
        "dateUpdated": "2026-10-19T08:58:18.680Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-10-19T08:58:18.680Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing\n\nIn gic_acpi_parse_iaffid() a given MADT GICC entry might not correspond\nto a logical cpu recognized by the kernel, resulting in the cpu variable\ninitialization to an error value.\n\nCurrently, the get_logical_index() return value is not checked for failure,\nwhich might result in out-of-bounds memory corruption while trying to\nindex a per_cpu variable array.\n\nAdd a check to evaluate get_logical_index() return value."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 8.4,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The triggering bytes are MADT GICC arm_mpidr/iaffid/irs_id fields parsed by gic_acpi_parse_iaffid() from acpi_table_parse_madt() on the init_IRQ()->irqchip_init()->gic_acpi_init()->gicv5_irs_acpi_probe() boot path; they arrive from firmware, a hypervisor ACPI blob, or an initrd MADT override, not from a network protocol message.\nAC:L - A MADT GICC with ACPI_MADT_ENABLED set and an arm_mpidr that acpi_map_gic_cpu_interface() never installed (invalid MPIDR, or cpu_count >= NR_CPUS) makes get_logical_index() return -EINVAL every boot; per_cpu() then uses that error index with no race or attacker-uncontrollable layout.\nPR:N - gic_acpi_parse_iaffid() is an __init MADT walker with no capable() or uid check, invoked from irqchip_init() before userspace; a crafted MADT GICC is consumed automatically, so no Linux account or user-namespace capability is required.\nUI:N - arm64 init_IRQ() calls irqchip_init(), which probes the GICv5 IRS MADT entry and walks GICC subtables via gicv5_irs_acpi_init_affinity(); the OOB store happens on that boot parse with no mount, open, or other victim action.\nS:U - The stores go to per_cpu(cpu_iaffid, cpu) and per_cpu(per_cpu_irs_data, cpu) in the host GICv5 IRS affinity setup; this stays inside the kernel's authority and is not a KVM guest-to-host, IOMMU, or sandbox crossing.\nC:H - Using get_logical_index()'s -EINVAL as the cpu argument to per_cpu() is an out-of-bounds write of gicc->iaffid and a kmalloc'd gicv5_irs_chip_data pointer through __per_cpu_offset[]; that kernel memory corruption can be leveraged for information disclosure.\nI:H - gic_acpi_parse_iaffid() writes gicc->iaffid, valid=true, and current_irs_data via per_cpu(cpu_iaffid/per_cpu_irs_data, cpu) when cpu is -EINVAL, corrupting memory outside the per-cpu arrays with attacker-influenced MADT data and a kernel heap pointer.\nA:H - __per_cpu_offset[-EINVAL] plus the subsequent per_cpu stores during gicv5_irs_acpi_probe() can target unmapped or live kernel data and oops/panic in init_IRQ() while bringing up GICv5, which is a full kernel availability loss."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/irqchip/irq-gic-v5-irs.c"
                    ],
                    "versions": [
                        {
                            "version": "35866efa52feaf48cc54a0745851a555654e1446",
                            "lessThan": "6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "35866efa52feaf48cc54a0745851a555654e1446",
                            "lessThan": "328affc639ce9873a7a0a3fd6b8339f19767529b",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/irqchip/irq-gic-v5-irs.c"
                    ],
                    "versions": [
                        {
                            "version": "7.0",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "7.0",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2.6",
                            "lessThanOrEqual": "7.2.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.3",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "7.0",
                                    "versionEndExcluding": "7.2.6"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "7.0",
                                    "versionEndExcluding": "7.3"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/6caeb878f809bdf0aec2fdd96f3d41ef4b69fc69"
                },
                {
                    "url": "https://git.kernel.org/stable/c/328affc639ce9873a7a0a3fd6b8339f19767529b"
                }
            ],
            "title": "irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}