A null pointer dereference occurs in the IOMMU subsystem when the kernel attempts to reset a PCI device. If the IOMMU default domain fails to allocate during the initial probe, the group->domain pointer is left NULL. The subsequent call to pci_dev_reset_iommu_done() tries to reattach the device and dereferences domain->ops->attach_dev, causing a kernel crash. This results in an immediate denial of service on the affected system.

All Linux kernel versions prior to the inclusion of the patch that resolves the null dereference are affected. The vulnerability applies to the generic Linux kernel vendor and includes any distribution using those kernels. No specific version range is listed, so any kernel that contains the vulnerable code path is vulnerable.

The CVSS score is not listed, and the EPSS score is unavailable, meaning the quantification of risk is uncertain. The vulnerability is not listed in the CISA KEV catalog. The attack requires local access to perform a reset on a PCI device that triggers the null reference, so the risk is moderate for local users and high for privileged users. The lack of an exploit description or remote access vector means the primary risk is a local denial of service.