The Linux kernel’s IOMMU/vt‑d subsystem misinitializes an RB‑tree node when a device does not support Address Translation Services (ATS). If a probe step then fails, the removal routine incorrectly treats the zeroed node as a tree root, corrupting the kernel’s RB‑tree structure. This corruption can overwrite kernel memory and may result in a denial‑of‑service, a crash, or, in the worst case, arbitrary code execution at kernel privileges. The weakness aligns with improper initialization and data structure corruption.

All Linux kernel releases that contain the vt‑d code prior to the incorporation of the fix are affected. The specific affected kernel versions are not listed in the current data, but any kernel that includes the IOMMU/vt‑d module before the patched commit is susceptible. Vendors listed in the CNA data are generic Linux distributions that ship the upstream kernel.

With a CVSS score of 8.2, the vulnerability is classified as high severity. The EPSS score of < 1% indicates a very low likelihood that the weakness will be actively exploited in the wild at present. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would likely require a local or privileged execution environment that can trigger a probe failure on a PCIe device lacking ATS support, activating the corrupted removal path. No public exploits have been reported, but the potential impact justifies prompt remediation.