The flaw in the Linux kernel IOMMU daemon (iommufd) occurs during an unmap operation. If an internal access is encountered, the routine skips the normal unmap callback but still holds a lock on bypassed, the reference count for that object remains incremented. The net effect is a reference counting leak that can cause memory usage to grow beyond what a normal unmap would expend.

All Linux kernel releases that do not include the commit that resolves the issue (0dbcdf4473a614adbd732d567c9b39ac0e040e0c). Any distribution shipping a kernel unchanged by this patch and that loads the iommufd module for IOMMU handling is affected.

The CVSS score of 4.4 indicates moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, implying a very low probability of exploitation in the wild. The attack vector appears to require privileged kernel access to trigger the unmap of an internal IOMMU object, as the vulnerable code path is exercised only by kernel components. The exposed leak may lead to incremental resource consumption, but no direct denial‑of‑service or privilege‑escalation vector is documented.