The issue arises in the Linux kernel’s IOMMU subsystem where iommufd_ioas_change_process iterates over I/O address spaces without verifying that each area’s pages pointer is non‑NULL. The pages pointer can remain NULL while the area is inserted into the interval tree and later populated under a different lock. A concurrent call to iopt_map_file_pages can therefore be observed by iommufd_ioas_change_process and dereference a NULL pointer, causing an immediate kernel panic. The resulting crash disables the affected system until reboot and could be leveraged by a local attacker to deny service or to force a context switch that might allow additional attacks if a kernel exploit exists.

This vulnerability is present in the Linux kernel itself; the vendor is listed simply as Linux:Linux. No specific kernel version range is supplied in the data, so any kernel build that includes the above IOMMU code before the patch commits is potentially affected. Users should check whether their current kernel version contains the commits referenced below to confirm exposure.

The severity of the crash is high, providing a full disruption of services and an elevated opportunity for privileged attacks if additional exploit paths exist. No CVSS score or EPSS value is available in the data; however, the described race condition and NULL dereference are classic characteristics of severe kernel bugs. The vulnerability is not listed in the CISA KEV catalog. While the attack requires a user or process to trigger the concurrent IOAS change and file-page mapping operations, the race condition can be reproduced under controlled conditions, indicating realistic exploitation potential for a local attacker. The lack of a public exploit does not mitigate the need for timely patching, as the kernel crash alone suffices to cause denial of service.