The flaw is a timing race in the Linux IOMMU driver that allows the need_sync flag to be cleared before all queued commands complete. In a multi‑CPU environment, a process may observe need_sync as false, return from iommu_completion_wait(), and proceed to free resources such as page‑table pages while the IOMMU still holds stale references. This window can be exploited to corrupt kernel memory, potentially enabling arbitrary code execution or escalation of privileges. The weakness is a classic race condition that violates the expected FIFO completion contract of the IOMMU interface.

All Linux kernels that include the AMD IOMMU driver, meaning any Linux distribution that ships a kernel built from code containing the iommu/amd implementation. The specific kernel versions are not enumerated in the CVE data, so any release that incorporates unrestricted access to the IOMMU functions is impacted.

The CVSS score of 8.8 indicates high severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so no public exploits are known. This race condition can still result in a use‑after‑free when a local attacker with adequate privilege manipulates IOMMU commands on a multithreaded system. Although the exploitation likelihood remains low, a successful attack would lead to kernel memory corruption, potentially allowing privilege escalation.