CVE-2026-90120 describes a vulnerability in the Linux kernel's irqchip/gic-v5 code, specifically in the gic_acpi_parse_iaffid() function. When parsing MADT GICC entries, a given entry might not correspond to a logical CPU recognized by the kernel, causing the cpu variable to be initialized with an error value. Because the return value of get_logical_index() was not checked for failure, this could lead to out-of-bounds memory corruption when indexing per_cpu variable arrays. The fix involves adding a validation check on the get_logical_index() return value to prevent such memory corruption.

The vulnerability can lead to out-of-bounds memory corruption, which may compromise system confidentiality, integrity, and availability. The CVSS score of 8.4 (high severity) reflects the potential for significant impact if exploited. No known exploits are reported in the wild at this time.

A fix has been implemented in the Linux kernel to add a check on the get_logical_index() return value in the MADT IAFFID parsing code. Users should apply the official kernel updates that include this patch to remediate the vulnerability. Since this is a kernel-level issue, updating to the fixed kernel version is the recommended mitigation.