OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-90120

HIGH · CVSS 8.4 EPSS 0.20%

Source: NVD + CISA KEV + EPSS · Published 2026-09-17 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's handling of the MADT IAFFID parsing, specifically in the gic_acpi_parse_iaffid() function, where the return value of get_logical_index() is not validated. This oversight can lead to out-of-bounds memory corruption when accessing the per_cpu variable array, potentially compromising system stability and security. Linux system administrators and developers working with kernel configurations should prioritize addressing this issue to mitigate the risk of exploitation.

CVE
CVE-2026-90120
Severity
HIGH
CVSS
8.4
EPSS
0.20%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing In gic_acpi_parse_iaffid() a given MADT GICC entry might not correspond to a logical cpu recognized by the kernel, resulting in the cpu variable initialization to an error value. Currently, the get_logical_index() return value is not checked for failure, which might result in out-of-bounds memory corruption while trying to index a per_cpu variable array. Add a check to evaluate get_logical_index() return value.