The vulnerability is a use‑after‑free in the Linux kernel’s amdxdna driver that occurs during the iommu_sva_unbind_device() operation. When a device is unbound, the code accesses an iommu_mm structure after the corresponding mm context has already been freed, causing a kernel crash. The crash can lead to a kernel panic and a system reboot, resulting in loss of availability for all running services.

The flaw exists in the Linux kernel’s amdxdna acceleration subsystem. Any kernel version that contains the unaffected commit before the patch is vulnerable; the data does not specify a particular version range, so all kernels prior to the inclusion of the fix are affected.

Exploitation requires a local, privileged user who can trigger bind or unbind operations on an AMD XDNA device. Once such a user can cause an unbind, the use‑after‑free will execute and crash the kernel. No remote exploitation method is documented, and the EPSS score is unavailable. The vulnerability is not listed in CISA KEV, but because the crash results in a kernel panic the risk to availability is high.