The Linux kernel’s iommufd component previously allocated memory for its vevent queue while holding a spinlock. Because the queue depth is supplied by user‑space, an attacker could request a depth large enough that the kernel would attempt to allocate a correspondingly large amount of atomic memory. This memory allocation occurs inside the spinlock, allowing the allocation to consume the kernel’s limited atomic memory reserves. The result is a kernel scenario where subsequent atomic‑allocation attempts fail or the system may become unstable, potentially causing a denial‑of‑service. The flaw combines improper memory management (CWE‑401) with unnecessary resource allocation (CWE‑770).

All Linux kernel releases that implement the original vevent queue logic before the commit introducing the fix are potentially vulnerable. The advisory does not list specific release numbers; therefore, any kernel tree that does not contain the commit 6c5fc40200… is considered at risk. Vendors maintain their own kernel branches, so users should verify whether their distribution includes the fix.

The CVSS v3.1 score of 5.5 places the vulnerability in the medium severity band. The EPSS score is below 1 %, indicating a low probability of exploitation in the current threat landscape. The vulnerability is not listed in CISA’s KEV catalog, and no publicly known exploits exist. Exploitation remains local; an attacker would need the ability to invoke iommufd and supply an unusually large queue depth. (Inferred: iommufd is usually accessed by privileged processes or device daemon applications, so privileged access is likely required.) If an attacker succeeds, the resulting kernel memory exhaustion could lead to system hangs or crashes, impacting availability.