The vulnerability in the Linux kernel affects the KVM arm64 virtual Generic Interrupt Controller's Interrupt Translation Service (vgic-its). Userspace could restore a Device Table Entry (DTE) whose Size field encoded more EventID bits than the virtual ITS supports. While the live MAPD path rejects such states, the vgic_its_restore_dte() function accepted and stored the out-of-range num_eventid_bits value. This flaw allowed the restored state to reach vgic_its_restore_itt(), potentially causing an oversized scan_its_table() range. The fix involves rejecting restored DTEs with num_eventid_bits greater than VITS_TYPER_IDBITS before device allocation, mirroring the MAPD check and preventing the invalid state from propagating.

The vulnerability could allow userspace to restore an invalid ITS Device Table Entry with an out-of-range num_eventid_bits value, potentially leading to inconsistent or unexpected behavior in the virtual ITS device state within KVM on arm64. No known exploits in the wild have been reported. The impact is limited to the internal state consistency of the virtual interrupt controller in KVM environments on arm64 architectures.

A fix has been implemented in the Linux kernel to reject restored DTEs with num_eventid_bits values exceeding the supported limit before device allocation. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Since no patch links or vendor advisories are provided here, users should consult the Linux kernel security advisories or their distribution's updates for the official fix.