Technical impact
A flaw in the idxd dmaengine driver can trigger an invalid memory access when a second Function Level Reset (FLR) fails to allocate its scratch area after a successful first FLR. The driver leaves a dangling pointer to a freed scratch area, does not nullify the reference, and mishandles the reset loop, which may cause the kernel to dereference invalid memory and corrupt kernel space, potentially leading to a crash or denial of service.
Affected Systems
This vulnerability affects any system running a Linux kernel that includes the idxd dmaengine driver. The flaw exists wherever the driver handles Function Level Resets on devices. No specific kernel versions are listed, so all vulnerable instances are at risk until the patch is applied.
Risk and Exploitability
The EPSS score of less than 1%, the CVSS score of 7.8, and the absence in the CISA KEV catalog indicate that active exploitation is currently unlikely. However, the vulnerability can still be triggered locally to cause a kernel crash or memory corruption, which would result in denial of service. The likely attack vector involves triggering a Function Level Reset on an idxd device through a privileged local interface.
