This kernel flaw occurs in the iommufd subsystem when the ioctl iommufd_hwpt_invalidate() processes a user-specified entry_num and entry_len that are only limited by U32_MAX. When an attacker supplies extremely large values, the kernel, while copying the user buffer, scans an enormous amount of memory and triggers the soft-lockup watchdog. Likewise, a large entry_num forces the backend loop to run without any rescheduling, causing the CPU to be locked in a non-preemptible kernel path. As a result, the kernel can lose responsiveness and exhibit a hard or soft lockup, effectively denying service to all users on the affected host.

The vulnerability is present in the Linux kernel, as identified by the CPE string covering all Linux kernel releases. No specific kernel version range is provided in the CNA data, so any recent kernel that implements the iommufd subsystem and has not yet applied the approved bounds should be considered at risk. Existing deployments that use the iommufd ioctl interface are potentially affected.

The CVSS score is 5.5, indicating moderate severity, but the EPSS indicates a very low availability of exploitable code (<1%). The vulnerability is not catalogued in CISA's KEV list. Practical exploitation requires local access to the iommufd ioctl, which is normally restricted by device permissions. If an attacker obtains such local privileges, they can invoke the ioctl with arbitrary entry_num and entry_len values. The lack of bounds causes a predictable denial-of-service effect, making this a significant usability risk but with limited threat surface. After the fix, entry_num is bounded to 1<<19 and entry_len to PAGE_SIZE, preventing the loop from exceeding safe limits.