The vulnerability exists in the Linux kernel’s DMA engine (idxd) subsystem and is caused by a logic error that results in the wrong DMA descriptor being completed during the llist_abort_desc() function. This mis‑completion can trigger NULL pointer dereferences, double completions, or leaf descriptor leaks. Specifically, the flaw involves a NULL pointer dereference (CWE‑476), use of uninitialized variables (CWE‑758), and incorrect pointer handling (CWE‑910). If exploited, the kernel may crash or the DMA engine may become unreliable, potentially causing kernel panics or service disruption due to corrupted DMA state.

Affected systems are Linux kernel versions that include the idxd driver before the commit that introduces the fix. The CNA vendor listing is "Linux:Linux" with specific version data identifying kernels 7.0-rc1 through rc6 as affected. Any kernel build containing the idxd driver older than the patch, including these release candidates, is vulnerable. No other versions are known to be affected.

The CVSS score is 9.8, and the EPSS score indicates a very low exploitation probability (<1%). The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploit as of this assessment. Based on the description, it is inferred that exploitation would require local or privileged access to the DMA subsystem, such as a process that can create or manipulate DMA descriptors for idxd. Remote exploitation is unlikely without such privileges, and the overall risk depends on the likelihood of a local attacker gaining sufficient privileges on the host.