In the Linux kernel’s iommufd subsystem, the page buffers tied to a dmabuf object are freed before the object is fully detached. This race condition allows the dmabuf invalidation callbacks to still reference memory that has been released, producing a use‑after‑free crash that can reboot the system or otherwise interrupt services.

All Linux kernel releases that lack the commit restoring the correct page destruction in iommufd are affected. The flaw is confined to the iommufd component and any modules or drivers that use the dmabuf interface.

The CVSS score of 8.8 indicates high severity. The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploit. The attack is likely to require local or privileged access to orchestrate the race, but the exact vector is not detailed in the advisory.