The Linux kernel ARM SMMU v3 IOMMU driver contains a flaw in the stream ID mapping logic within the armmmu_vsid_to_sid routine. The code defaults to using the first entry in master->streams and assumes each device has exactly one stream, ignoring the actual stream count. A device that advertises multiple streams therefore has only its first stream recorded, leaving the remaining ATC and IOTLB entries of the other streams unchanged when a guest vSID is invalidated. If the device declares no streams, the code dereferences a zero‑size pointer and reads past its bounds. This improper handling can produce stale translation tables in the I/O domain, memory corruption, or loss of isolation between guest and host. The consequence is a loss of isolation that may expose sensitive data or cause kernel instability, potentially enabling a malicious guest to elevate privileges or disrupt I/O operations.

All Linux kernel builds that include the ARM SMMU v3 IOMMU subsystem are affected, since the flaw resides in a core driver rather than in vendor‑specific patches. Any hardware implementing the ARM SMMU v3 specification and used in conjunction with a Linux I/O management unit is therefore subject to this vulnerability. No specific kernel version is listed, so kernels compiled with an older or unpatched SMMU driver remain at risk.

EPSS indicates a probability of less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been reported. The CVSS score is 9.3, indicating a critical severity. Based on the description, it is inferred that the attack path requires the ability to create or modify a vDEVICE in an SMMU‑managed Linux guest, a capability typically restricted to privileged management software. Consequently, the risk is that of local privilege escalation within the hypervisor or a KVM guest. Nonetheless, the kernel bug could be used to bypass IOMMU stream isolation or to corrupt guest mappings, presenting a high‑risk kernel‑level issue.