The Linux kernel’s iommu_map_sgtable() originally returned an unsigned size_t and produced a WARN when mapping failed. The patch changes the function to return a signed ssize_t, allowing negative values to indicate errors and to store the return value in the correct type. In an unpatched kernel, a zero return is misinterpreted as success, causing error conditions to be ignored and potentially leading to degraded system stability.

All builds of the Linux kernel that do not include the commit correcting iommu_map_sgtable(), such as mainstream distribution kernels and custom or embedded builds that lack the change, are affected. No particular version numbers are provided in the data.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% indicates that the likelihood of exploitation is very low at this time. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector would require an attacker to trigger a faulty IOMMU mapping operation through a device driver or hardware component that calls iommu_map_sgtable. This generally requires privileged kernel mode or a compromised driver; successful exploitation would cause a kernel failure or degraded operation.