The vulnerability arises in the Linux kernel's IOMMU subsystem, where freeing an IOMMU domain leaves a pointer to the domain's memory‑management structure dangling. Subsequent code accesses this freed structure, causing a null or invalid pointer dereference that results in a kernel crash. This can be triggered when a device is unbound from an IOMMU domain, leading to a denial of service because the entire system may panic.

The flaw is limited to the Linux operating system kernel, particularly code paths that invoke iommu_sva_unbind_device(). No specific kernel release versions are enumerated in the advisory, so all kernels containing this code path without the applied fix are potentially impacted. Systems running a kernel that has not integrated the patch commit are vulnerable.

The severity is high because a kernel crash can terminate critical services or bring the host down. While the CVSS score is not provided, use‑after‑free weaknesses typically receive high scores. The exploit requires that an attacker can cause the unbinding operation, which is usually privileged. Therefore, the attack vector is local with kernel privileges. Because the exploit is not publicly documented and the EPSS score is unavailable, the likelihood of exploitation remains uncertain, but the impact warrants immediate mitigation. The vulnerability is not listed in the CISA KEV catalog.