The vulnerability is in the Linux kernel’s accel/qaic module where the remap_pfn_range function used during mmap can map device memory beyond the bounds of a target virtual memory area. When the buffer object is larger than the VMA, the remapped memory extends past the VMA, and a subsequent munmap removes only the VMA portion. The leftover mapping can then be accessed as a use‑after‑free, potentially corrupting kernel memory. This flaw does not allow direct code execution but can compromise the integrity of the kernel if exploited. The weakness identified is CWE‑787, an out‑of‑bounds write condition.

Linux kernel implementations that include the accel/qaic driver without the recent overflow check are affected. All kernels shipped prior to the commit that added the bounds verification in remap_pfn_range are potentially vulnerable. No vendor‑specific version constraints are listed; the issue is inherent to the Linux kernel and its accel/qaic driver code.

The CVSS score of 7.8 marks this a high‑severity vulnerability. The EPSS score of less than 1 % suggests a very low probability of active exploitation in the wild, and the vulnerability is not currently catalogued in the CISA KEV list. The likely attack vector is local; it requires the ability to load a device buffer that exceeds the VMA size and trigger the remap during mmap. Because the flaw results in a use‑after‑free, exploitation needs precise conditions but could lead to kernel memory corruption or instability.