The Linux kernel’s iommu/iommufd subsystem fails to acquire the dma_resv lock before calling dma_buf_unpin in the release path. dma_buf_unpin requires the lock and will assert if it is not held, resulting in a kernel warning and exposing a race condition that can corrupt shared state or trigger a crash when multiple threads release pages concurrently. This flaw can destabilize the kernel without directly leaking data or providing control to an attacker.

All Linux kernels containing the iommu/iommufd code before the commits that added the missing lock are potentially affected. Coverage includes mainstream distributions, as the vendor list is unspecified, meaning any distribution kernel compiled with the iommu framework and utilizing DMABUF‑backed iopt_pages that has not applied the patch remains vulnerable.

The likely attack vector is local, requiring an attacker to perform a release operation such as unmapping or closing an iommufd‑backed device that holds a DMABUF reference. Because the flaw exists only in the release path, it cannot be triggered remotely and requires the attacker to have write privileges to the relevant device. The EPSS score is below 1%, indicating a very low but nonzero probability of exploitation. The CVSS score of 8.8 indicates a high severity flaw that could lead to a kernel crash or denial‑of‑service if repeatedly invoked. The vulnerability is not listed in the CISA KEV catalog, meaning no widespread exploitation has been reported yet.