In the Linux kernel, the IOMMU driver function iommufd_take_all_iova_rwsem() fails to release the current IOAS reference and its write lock when an xa_store() operation does not succeed. As a result, the current IOAS remains locked and an object reference is left dangling. This bug triggers a resource leak in the kernel and can lead to device I/O failures or kernel instability when the locked IOAS is not released during unwinding. The flaw represents a CWE‑772 vulnerability: a missing release of a resource after its acquisition.

The issue resides in the generic iommufd driver that is part of the mainline Linux kernel. Any kernel build that contains the iommufd_take_all_iova_rwsem code path is potentially affected. Because the vendor list is just Linux, the problem applies across all distributions that ship the default Linux kernel with this module enabled, regardless of distribution or kernel version, unless a later kernel version back‑ports the fix.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score of less than 1% suggests the exploitability probability is very low. The flaw is not listed in CISA’s KEV catalog, implying no public widespread exploitation has been reported. The defect occurs entirely within kernel data structures, so the likely attack vector is a local attacker with kernel execution privileges or a compromise that escalates privileges to the kernel. An attacker would need to trigger an xa_store() failure while the current IOAS is held, then observe that the lock is not released, potentially causing a deadlock or resource leak that degrades system performance or stability over time. The impact is limited to resource exhaustion and instability rather than direct remote code execution.