The Linux kernel’s IOMMU subsystem can trigger a WARN_ON in __iommu_group_set_domain_nofail() during device reset. If a device in a multi‑device group recovers concurrently, the group’s domain pointer may be used after it has been freed, creating a use‑after‑free condition that could allow memory corruption. The description indicates that the failure could lead to a use‑after‑free when re‑attaching the domain after a reset, which potentially permits an attacker controlling device reset operations to manipulate memory. The potential impact is privilege escalation.

The flaw resides in the core Linux kernel IOMMU code and therefore applies to any Linux installation that has not applied the upstream fix referenced in the commit logs. The affected product is the Linux kernel from the Linux vendor; specific version details are not provided.

No CVSS or EPSS score is available and the vulnerability is not listed in CISA KEV, suggesting a moderate exploitation likelihood. The attack would require local or privileged access to trigger device resets and manipulate IOMMU domain assignments, which may be feasible on systems with poorly secured device interfaces. Because the bug leads to a use‑after‑free, exploitation could result in arbitrary code execution or privilege escalation within the kernel context. The exact attack vector is inferred from the description and not confirmed by any public exploit.