A critical memory corruption vulnerability in the Linux kernel GIC-v5 driver, identified as CVE-2026-90120, poses a significant risk of local privilege escalation or system instability.

The vulnerability exists within the gic_acpi_parse_iaffid function, where the kernel fails to validate the return value of get_logical_index. This lack of validation allows an unauthenticated local attacker to trigger out of bounds memory corruption when processing malformed MADT GICC entries.

The exploitation of this vulnerability could result in total system compromise, including unauthorized access to sensitive data and complete loss of system availability. With a CVSS score of 8.4, this flaw is categorized as high severity due to its potential to facilitate local privilege escalation, which could be leveraged by an attacker to bypass kernel security boundaries.

Immediate Action: Administrators must update the Linux kernel to version 7.2.6 or later to incorporate the necessary validation checks.

Proactive Monitoring: Security teams should monitor system logs for unusual kernel panic events or segmentation faults that may indicate failed exploitation attempts.

Compensating Controls: Ensure that access to the underlying hardware and kernel interfaces is strictly restricted to authorized administrative users to limit the attack surface for local exploits.

Public Exploit Available: No

Given the potential for memory corruption and privilege escalation, this vulnerability represents a significant risk to kernel integrity. Organizations should prioritize patching affected systems to version 7.2.6 immediately to eliminate the risk of exploitation.