The vulnerability resides in the Linux kernel’s IOMMU subsystem, where a missing flush of the device IOTLB can cause the kernel to wait indefinitely for an ATS invalidation on a PCIe endpoint that has lost its link. This results in a hard lock of the host, disabling all further operations and effectively denying service to all users. The failure originates from an improper check of device connectivity and leads to a system state where the kernel is effectively hung.

The flaw is present in all Linux kernel releases that lack the recent commit patches. It affects all Linux distributions that compile the generic kernel and employ IOMMU pass‑through devices such as those used by QEMU or DPDK. The issue occurs when the IOMMU is operating without scalable mode, whether due to a hardware limitation or an explicit kernel setting, and especially on Intel platforms that support ATS. Users of any kernel that has not integrated the commit adding pci_device_is_present checks are vulnerable.

Because the flaw is triggered by an external condition—a PCIe endpoint link loss—the attacker or even a faulted device can easily induce the hang. The lack of a public CVSS score or EPSS score in the CVE data means the quantitative risk is unclear, but a system lock is a high‑impact outcome. The vulnerability is listed as not included in CISA KEV, yet the ease of exploitation by forcing a link drop suggests a high likelihood of real‑world impact on systems that use the IOMMU for device passthrough. The mitigation requires applying the kernel patch or enabling scalable mode to prevent the wait condition.