A flaw in the idxd dmaengine driver can trigger an invalid memory access when a second Function Level Reset (FLR) fails to allocate its scratch area, after a successful first FLR. The driver does not set the deallocated scratch area to NULL, leaving a dangling reference that may be dereferenced during the FLR process, potentially leading to a kernel memory corruption or crash.

This vulnerability affects any system running the Linux kernel that includes the idxd dmaengine driver, which is common on platforms that provide Intel Data Plane Acceleration (DPA) infrastructure. The discrepancy is limited to kernels that have not been updated to include the corrective changes. No specific kernel version is listed, so all kernels using the vulnerable driver path are at risk until the patch is applied.

Because the flaw resides in a kernel driver, exploitation would likely require local privileged access or the ability to trigger a Function Level Reset via a device interface. A successful exploitation could cause a kernel panic or memory corruption, leading to denial of service or, if memory corruption is leveraged, escalation of privileges. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that active exploitation is not widely reported at this time. Nevertheless, the high impact of a kernel crash warrants immediate attention.