In the Linux kernel, the iommu/vt‑d driver performs a race condition by writing the address of a newly allocated, zero‑initialized PASID table to the PASID directory before flushing the CPU cache for that table. This timing window can allow non‑coherent IOMMU hardware to see stale, non‑zero contents in the table while the kernel still holds uninitialized data, enabling a device to read or write memory locations it should not access. The flaw is a race condition due to improper cache handling (CWE-821) that can lead to memory corruption or a privilege escalation for the device or hypervisor controlling the IOMMU device.

All Linux kernels built from the upstream source before the commit that reorders the cache flush and PASID directory write are affected. The listed CPE covers every Linux kernel installation, so any distribution using a kernel version prior to the fix is vulnerable until the patch is applied.

The CVSS score of 7.8 indicates high severity, but the EPSS score of < 1 % suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread attacks. Successful exploitation would require an attacker to control a device or hypervisor capable of IOMMU passthrough and to time the device’s access to the PASID table during the narrow race window. Because the attack vector is hardware‑dependent and requires precise timing, the overall risk remains low to moderate in most environments, but it is significant in contexts where untrusted devices are allowed direct passthrough.