A flaw in the Linux kernel IOMMU subsystem causes a use‑after‑free of IOPF group objects, which could allow an attacker to corrupt kernel memory and potentially execute arbitrary code or crash the system. The vulnerability is triggered when a device’s IOPF reference count drops to zero, causing the kernel to free group structures that are still queued for user‑space response. The likely attack vector involves manipulating device detach or hardware pass‑through replacement operations that exercise this code path. Proper exploitation would require privilege escalation to the kernel level but could be devastating once achieved.

The defect exists in the Linux kernel code for IOMMU (iommu and iommufd components). No specific version numbers are listed; the issue applies to any kernel containing the vulnerable code prior to the applied fix and would be mitigated by updating to a kernel revision that includes the commit implementing the patch.

The CVSS score of 8.8 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known active exploits. Nevertheless, the use‑after‑free nature exposes the kernel to potential privilege escalation or a denial‑of‑service scenario if an attacker can trigger the fault path. The risk is considered high, especially on systems where IOMMU functionality is enabled and devices are frequently detached or updated.