The Linux kernel’s vt‑d implementation zeros a 128‑bit context entry by writing two 64‑bit halves without first clearing the Present bit. If the IOMMU hardware reads the entry while the clears are in progress, it may observe a partially zeroed entry with the Present bit still set, creating a dangling reference. This “torn” entry can cause unpredictable behaviour, spurious faults, or allow a DMA‑capable device to access stale or incorrect memory mappings, potentially leading to memory corruption or privilege escalation.

All Linux kernel versions that include the buggy context‑teardown logic are vulnerable. Because the patch lists no explicit affected range, any kernel prior to the commit that introduces the dma_wmb() ordering and clears the Present bit first is affected. Users of x86 systems with IOMMU enabled should verify their current kernel version against the fix commit.

No CVSS or EPSS values are published and the issue is not listed in CISA KEV, suggesting no known active exploitation yet. Nonetheless, the flaw gives a local attacker who can control or inject a DMA device the ability to read or write arbitrary kernel memory through a torn context. The risk is therefore moderate to high in environments where untrusted devices access the IOMMU, with an attack vector that is likely device‑based and local.