The vulnerability arises from a race condition between a PCI posted write used to raise an MSI‑X interrupt and the subsequent unmap of the outbound address translation entry (ATU). If the write races with the unmap, host memory may be corrupted or IOMMU translations may fault, leading to data integrity breaches or kernel stability problems. This is a Classic Atomicity violation (CWE‑367) that undermines the correctness of PCI transaction sequencing, potentially exposing confidential data or causing denial of service.

The issue exists in the Linux kernel’s dwc endpoint drivers and affects all kernel versions that include the dv_pcie_ep_raise_msix_irq routine before the patch that ensures the write completes before the ATU is unmapped. The problem exists across all Linux distributions that compile the kernel with this driver, as no vendor‑specific version restrictions were identified.

With a CVSS score of 5.5 and an EPSS of less than 1 %, the risk of exploitation is moderate but low likelihood. The attack requires control over or interaction with a PCI‑E endpoint device that triggers MSI‑X interrupts; an attacker could cause memory corruption or trigger IOMMU faults to destabilize the host. The vulnerability is not listed in the CISA KEV catalog, and there is no public exploit known, but defenses‑against‑failure techniques recommend addressing it promptly.