The kernel lacks a required instruction to perform I/O TLB and context cache invalidations after updating the DDT or PDT entries, as mandated by the RISC‑V IOMMU specification. Because stale entries may continue to be used, privileged processes could read or write memory that should belong to other contexts, leading to data leak or corruption. The missing cache clean also opens the possibility for a privileged user to maintain an outdated mapping that enables escalation or unauthorized access to restricted device memory.

All RISC‑V implementations of the Linux kernel that employ IOMMU support are impacted, including those distributed by major vendors. The vulnerability is introduced in kernels that do not contain the commit adding the iommu_iotinval call; any kernel version prior to the reference commit present in the Linux repository is affected.

No EPSS score is currently available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that active exploitation is not widespread. However, the missing invalidation could be leveraged by a local attacker with kernel privileges, or by an exploited device driver to gain higher access. The potential impact on confidentiality, integrity, and availability is serious, although the probability of exploitation remains uncertain at this time.