The Linux kernel VFIO‑PCI subsystem contained a race condition in device shutdown. The function associated with a PCI device was disabled before the kernel cleaned up its DMA buffer (DMABUF) references. During the narrow window between disabling the function and clearing the Memory Selection Enable bit, a DMABUF handle could still access the device's Base Address Registers (BARs). This permitted an attacker to read or write hardware registers and memory that should have been protected, which could be used to manipulate device internals and potentially elevate privileges or destabilise the system. Although the advisory does not explicitly state privilege escalation, the ability to access protected device registers is inferred to enable such an outcome.

All Linux kernel releases prior to the commit series referenced in the CVE links are affected. The vulnerability resides in the vfio_pci module of the kernel source; any kernel image that does not include the linked patches is vulnerable. Systems that run kernels lacking those changes must upgrade.

The flaw carries a CVSS score of 8.8, denoting high severity, and an EPSS score of <1%, indicating a low probability of exploitation in the wild. It is not listed in CISA’s KEV catalog. Exploitation requires a process with sufficient privileges to trigger a VFIO‑PCI device shutdown or to load a malicious driver that performs the race. The likely attack vector therefore involves an elevated or compromised driver or privileged user initiating the device shutdown, creating the narrow race window for exploitation.