The vulnerability is a use‑after‑free (CWE‑825) in the Linux kernel’s IOMMUFD selftest TRIGGER_IOPF function. An attach handle is borrowed from a PASID array without proper synchronization, and a concurrent iommu_report_device_fault() call can free that handle while it is still referenced. This causes a dereference of freed memory, which can crash the kernel and potentially expose sensitive information. The flaw does not provide a direct route to privilege escalation but can lead to a denial of service.

This flaw affects Linux kernel builds that include the IOMMUFD selftest and lack the iopf_rwsem synchronization introduced to fix the issue. The specific kernel versions are not enumer any kernel prior to the commit that added the lock may be impacted. Exact version information is missing.

The CVSS score of 4.1 indicates low to moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to trigger the selftest and fault report, and the primary consequence is a kernel crash leading to service disruption, rather than direct privilege escalation or data exfiltration.