The flaw arises in the Linux kernel PCI driver for dwc endpoints when a posted MSI write is not flushed before the iATU mapping is removed, causing the write to be lost or misrouted. This can prevent the expected interrupt from reaching the kernel, leading to missed or delayed device notifications, degraded performance, or a denial of service if the device repeatedly fails to generate required interrupts. The weakness is an incorrect or incomplete implementation of the MSI flush mechanism.

All kernel releases that incorporate the dwc endpoint PCI driver without the posted‑write flush fix are affected. The flaw is present in the generic Linux distribution; no vendor‑specific product versioning is provided, implying that any kernel prior to the commit that introduces the readback before unmapping is vulnerable.

The CVSS score of 8.2 denotes a high severity. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating that no public exploits are known and that the likelihood of exploitation is very low. Based on the description, it is inferred that an attacker would need to trigger a scenario in which the endpoint performs an MSI write while the root complex changes the target address, which is typically possible only in privileged contexts or on devices belonging to the attacker. The likely attack vector is therefore limited to controlled environments where the attacker can influence device configuration or have privileged access. Thus while the defect can disrupt normal operation, it does not enable remote code execution or privilege escalation without prior compromise.