The flaw resides in the iommufd fault‑handling code within the Linux kernel. When a copy_to_user operation fails while reading, the inner loop is aborted but the outer while loop continues to re‑fetch the same fault group. The fault->mutex remains locked and the reader spins indefinitely, consuming 100 % of CPU time. This uncontrolled loop represents a classic resource exhaustion problem and is classified under CWE‑835 (Uncontrolled Resource Consumption).

All Linux kernel releases that include the iommufd code prior to the commit that introduced the break on copy_to_user failure are affected. The advisory does not provide an explicit version range, so any kernel version before the patch should be considered vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating low probability of widespread exploitation. Based on the description, it is inferred that a successful attack requires triggering the fault‑handling path, which typically demands kernel‑level interaction or a compromised privileged user. Hence the risk is focused on privileged contexts, but if the flaw is exploited the system suffers a significant denial of service due to sustained CPU saturation.