Technical impact
A use‑after‑free occurs in the Linux kernel when iommu_sva_unbind_device() accesses a freed mm structure after iommu_domain_free() has released domain->mm->iommu_mm. This results in a kernel crash. The vulnerability is purely a denial‑of‑service issue that compromises system availability.
Affected Systems
The flaw affects the Linux kernel, specifically any distribution that employs the iommu/sva IOMMU implementation. No particular vendor versions are identified in the data, so all kernels that include the vulnerable code path are potentially affected until the fix is applied.
Risk and Exploitability
The reported CVSS score of 7.8 and an EPSS score of less than 1% indicate a high severity but very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local kernel access, as a remote attacker would need to inject code into kernel space to trigger the crash. The intrinsic nature of the bug means that exploitation would lead to a hard reboot or crash rather than data exfiltration or privilege escalation.
