CVE-2026-90120: irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing
In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v5: Check getlogicalindex() return value in MADT IAFFID parsing
In gicacpiparseiaffid() a given MADT GICC entry might not correspond to a logical cpu recognized by the kernel, resulting in the cpu variable initialization to an error value.
Currently, the getlogicalindex() return value is not checked for failure, which might result in out-of-bounds memory corruption while trying to index a percpu variable array.
Add a check to evaluate getlogicalindex() return value.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using the GIC v5 irqchip ACPI parsing path, specifically when MADT GICC entries are processed by gic_acpi_parse_iaffid(). The problematic condition occurs when a MADT GICC entry does not correspond to a logical CPU recognized by the kernel.
What condition leads to memory corruption?
Memory corruption can occur when get_logical_index() fails but its error return value is used as a CPU index for a per-CPU variable array. The fix adds validation of that return value before indexing the array.