The Linux kernel contains an integer overflow in the IOMMU invalidation path on RISC‑V architectures. When a sign‑extended page table reaches ULONG_MAX, adding one to that value wraps, causing the kernel to enter an endless loop while walking the table. The infinite loop locks the thread that performs the invalidation, effectively denying service to processes that depend on IOMMU operations.

Linux kernel versions on RISC‑V hardware that use the IOMMU subsystem with sign‑extended page tables are affected. Any kernel build before the commits listed in the references (40a13b4, 9f0632b, e4b7687) contains the flaw, regardless of specific sub‑release numbers.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires triggering an IOMMU invalidation, which a local privileged user or an attacker controlling a device could influence. The risk is medium for systems that regularly perform IOMMU invalidations and do not have mitigations in place.