The Linux kernel function that releases pages from an IOMMU-managed buffer does not acquire the required reservation lock before calling dma_buf_unpin. Because dma_buf_unpin asserts that it is called while holding this lock, the missing lock causes a kernel warning and can expose a race condition that may lead to inconsistent state or a crash if multiple threads enter the release path concurrently.

All Linux kernels that include the iommu/iommufd code prior to the commit that added the lock. The issue is specific to the iommu framework and any modules that map DMA buffers using iommufd. No vendor or version list is provided, so every distribution kernel that has this code and has not applied the patch is potentially affected.

The vulnerability is local and requires the ability to trigger iommufd release paths, such as by unmapping or closing a DMA‑buffer backed device. The CVSS score is not supplied and the EPSS value is not available, so the exploit probability cannot be quantified precisely. Because the flaw leads to a kernel warning that could evolve into a denial‑of‑service if repeatedly triggered, it poses a moderate to high stability risk. It is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited, but systems that rely heavily on DMA‑buffer delivery should consider it a serious issue given the potential for kernel instability.