An AMD IOMMU driver race condition in the Linux kernel serializes CMD_COMPL_WAIT command sequencing incorrectly due to incrementing cmd_sem_val outside the spinlock during concurrent TLB invalidations. This concurrently executed bug, identified as CWE-1066 and indicated in NVD-CWE-noinfo, can cause completion waits to time out unpredictably, violating wait_on_sem() ordering assumptions and potentially leading to kernel hangs or crashes.

Any Linux kernel that includes the AMD IOMMU subsystem before the patch commit. The vulnerability is not tied to a specific kernel release; all versions containing the vulnerable code path are potentially impacted. The fix is available in recent kernel releases after commit 48caa7542a795c9679ec1bd1bc2592e05a7369a4.

The CVSS score is 5.5, EPSS score is < 1%, and it is not listed in CISA KEV. Exploitation would require triggering concurrent TLB invalidations and queuing CMD_COMPL_WAIT commands, a scenario that generally demands privileged or kernel-level code. Consequently, local or remote attackers with kernel execution capabilities could abuse the race to cause a denial of service, but the probability of exploitation remains uncertain. Given the impact of a kernel crash and lack of user‑level mitigations, the risk is considered high for affected systems.