The vulnerability comes from the iommu/amd clone_alias() function incorrectly assuming that its first argument is always the original device pointer. Because pci_for_each_dma_alias() can provide an alias device pointer, the source device identifier used to look up and copy the Device Table Entry (DTE) may be wrong. This results in wrong or stale DTE entries being propagated to the alias device.

Any Linux kernel that uses the iommu/amd module prior to the commit that fixes clone_alias() is potentially affected. The affected versions are not explicitly enumerated in the CVE description, so any system running a kernel built before the patch is considered vulnerable. The vendor is the Linux kernel project.

The CVSS score of 8.8 indicates a high severity. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. The description does not state an explicit attack vector. Based on the description, it is inferred that a local attacker with the ability to load a malicious kernel module or influence PCI device enumeration could trigger the incorrect mapping, resulting in stale or incorrect DTE propagation. Consequently, the risk remains high, especially in environments that rely on strict device isolation.