The Linux kernel’s IOMMU fault handling module contains a logic error: during a device replacement, the function iommufd_auto_response_faults is invoked with the wrong hardware fault pointer. Instead of passing the old fault domain, the code mistakenly passes the new domain, causing the system to reference stale fault information. This incorrect parameter usage prevents the kernel from correctly delivering or responding to IOMMU faults for the affected device, which can interrupt fault processing, lead to kernel stalls, or cause degraded system stability.

All Linux kernel releases that include the iommufd module and have not applied the corrective commit (identified by the references in the data). Distribution kernels shipped before the patch commit are affected; kernels that already incorporate the fix are safe. The issue is tied to the iommufd_hwpt_replace_device function and its interaction with iommufd_auto_response_faults, so environment setups that perform hot‑plug replacement of IOMMU devices are most relevant.

The vulnerability has no listed EPSS score and is not present in the CISA KEV catalog, indicating that no widespread exploitation is known. Exploitation would require local or privileged kernel access to trigger an IOMMU device replacement, so a remote exploitation vector is unlikely. The failure to handle faults can result in system instability or potential denial of service, which represents a moderate risk for workloads heavily reliant on IOMMU fault resilience.