CVE-2026-43351

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for arm64 architectures. When a virtual Generic Interrupt Controller (GIC) is created, a failure in the vgic_allocate_private_irqs_locked() function can leave internal data structures uninitialized. This can lead to a system crash when the KVM module attempts to free these uninitialized regions, resulting in a denial of service.

This vulnerability is rated as Moderate impact because exploitation requires local access to the KVM virtualization subsystem on ARM64 systems with privileges to initiate virtual machines, limiting the blast radius to a denial of service on the host. The issue only manifests on 64-bit ARM hardware when an unexpected allocation failure occurs during the initialization of the virtual interrupt controller. Deployments on non-ARM architectures or systems where KVM virtualization is not utilized remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.