In the Linux kernel the function iommufd_veventq_alloc() accepts any non‑zero veventq_depth value from userspace, allowing a depth up to 32‑bit unsigned maximum. This permits an attacker to request an event queue with an arbitrarily large number of entries, causing the kernel to attempt to allocate a correspondingly large block of memory. If the allocation succeeds the system can exhaust its kernel‑reserved memory and become unavailable, a classic resource‑exhaustion flaw identified as CWE‑770 and NVD-CWE-noinfo.

The issue is present in all Linux kernel releases prior to applying the patch that caps veventq_depth at 524,288 entries (1<<19). No specific version numbers are listed, so all vulnerable kernels should be considered at risk until updated.

The vulnerability can be exploited by a user that has access to the iommufd interface; the likely attack vector is local exploitation, based on the fact that the function is called from userspace. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation. Nevertheless, successful exploitation can deplete kernel memory and cause a denial‑of‑service. The CVSS score of 5.5 reflects a medium severity risk.