A revert commit in the Linux kernel introduced a second iounmap call on a NULL pointer in the error path of msix_capability_init(), causing the kernel to crash with a panic. The flaw arises when msix_setup_interrupts() fails and the cleanup sequence attempts to unmap the MSI‑X region twice—once correctly in pci_free_msi_irqs() and once incorrectly in the reverted code. The result is a kernel shutdown that can be triggered by drivers or misconfigured PCIe devices that force the error path, leading to loss of availability for the affected system.

The vulnerability is present in any Linux kernel that contains the erroneous revert commit, regardless of distribution or specific hardware. All versions that have incorporated the revert until the fix is applied are potentially affected. No specific version range is listed, so any kernel prior to the patch that includes the commit must be examined for the presence of the revert. All systems running the affected kernel, including those using Intel Emerald Rapids and similar hardware where the issue was reproduced, are susceptible.

With a CVSS score of 5.5, the bug carries moderate risk. The EPSS score is below 1%, and the flaw is not listed in the CISA KEV catalog, indicating that exploitation is not widespread. The attack vector is local, requiring a process with the ability to influence the error path of a PCIe driver or to load a malicious kernel module. An attacker with such privilege can cause a kernel panic and thus a denial of service. Remote exploitation is not described by the available information.