The vulnerability occurs in iommu_mmio_write() and iommu_capability_write() where user‑supplied offsets are parsed as unsigned 32‑bit values. A sufficiently large input can wrap to a negative integer, which then bypasses existing bounds checks and leads to out‑of‑bounds memory reads or writes. Such kernel memory corruption can allow an attacker to read sensitive data or potentially execute arbitrary code if the corrupted region controls execution flow. The patch replaces the unsigned parser with a signed one and explicitly rejects negative values, thereby preventing the out‑of‑bounds access.

All Linux kernel installations that have not incorporated the patch identified by commit 488d2c76 (and related kernel tree changes). Vendor impact is Linux; any distribution using the Linux kernel prior to the patch is potentially vulnerable.

The CVSS score is 5.5, indicating a moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting that current exploitation activity is low. The likely attack vector is a local user who can write to IOMMU debugfs entries, which is typically restricted to privileged users; if the debugfs interface is exposed to unprivileged users, the risk would increase. The conditions for exploitation require the presence of the vulnerable debugfs interface and correct input formatting to trigger the out‑of‑bounds behavior.