Abstract: To address the limitations of large language models (LLMs) in source code vulnerability detection—namely insufficient utilization of program structural information, unstable reasoning processes, and high fine-tuning costs—this paper proposes a vulnerability detection framework that integrates graph-based representations with LLM reasoning capabilities. The proposed method constructs data flow graphs (DFGs) from source code to model variable dependencies and semantic propagation paths, and aligns graph features with the semantic embedding space of LLMs through a cross-modal mapping module, enabling effective injection of structural knowledge into the language model. Furthermore, a progressive pretraining strategy based on code reconstruction tasks is designed to enhance the graph encoder’s ability to capture vulnerability-related structural patterns. On this basis, structured reasoning distillation and parameter-efficient fine-tuning via Low-Rank Adaptation (LoRA) are incorporated to transfer vulnerability analysis knowledge from teacher models to student models, improving detection performance while reducing training overhead. In addition, a chain-of-thought reasoning process tailored for vulnerability detection is introduced to improve interpretability and reasoning consistency. Experimental results demonstrate that the proposed method significantly improves both the accuracy and robustness of source code vulnerability detection while maintaining low fine-tuning cost.