Based on the description, it is inferred that the vulnerability is a use‑after‑free in the Linux ARM SMMU v3 driver (tegra241_cmdqv). On a probe failure or device unbind, the command queue memory is freed before the driver’s remove function runs, and the VINTF deinitialization later issues a CMD_SYNC on that freed memory, causing a kernel oops. This memory corruption can be exploited by a local attacker to trigger a kernel crash and potentially elevate privileges.

Any Linux kernel that contains the tegra241_cmdqv driver before the patch is applied. The flaw lives in the iommu component of the kernel for Tegra‑based ARM platforms, but no explicit kernel version range is listed in the data.

Based on the description, the likely attack vector is a local attacker initiating a device teardown, such as unloading the driver or performing a reset. The flaw is triggered during device teardown, typically by a privileged or malicious driver performing an unload or reset. No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating it was not publicly exploited at the time. Because the bug allows use of freed memory in a kernel context, a local adversary could reliably cause a crash or possibly gain elevated privileges, making the risk high in a local context even though the exploitability is presently limited to privileged code.