In the Linux kernel, the IOMMU/vt‑d driver writes the address of a newly allocated zero‑initialized PASID table to a PASID directory entry before performing a CPU cache flush for the table. This ordering creates a narrow race window where a non‑coherent IOMMU device could read or write the table while stale data remains in the cache, potentially causing memory corruption or privilege escalation. The weakness is an improper ordering of operations (CWE‑362) and a race condition that writes unintended data to hardware‑managed memory (CWE‑821).

All Linux kernels built from upstream source before the commit that moved the cache flush before writing the PASID directory are affected. The CPE string covers every Linux kernel installation, so any distribution that has not yet applied the commit is vulnerable. Updated kernels contain the fix and have been released as a patch.

The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1 % indicates a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, which suggests it has not been widely exploited. The likely attack vector requires an attacker who controls an IOMMU passthrough device or a privileged hypervisor and can time the device's access to the freshly allocated PASID table during the narrow race window. Because the attack relies on precise timing and non‑coherent cache behavior, its overall risk remains low to moderate in most production environments, but it is significant for systems that expose untrusted passthrough devices.