The Linux kernel arm_smmu-v3 driver contains an incorrect teardown order where the IOPF queue is freed before the IRQ handler that relies on it runs, resulting in a use‑after‑free condition. If the kernel processes an interrupt after the device has been removed, it may access freed memory, leading to a kernel crash and potential denial of service. The weakness is a classic use‑after‑free flaw. This flaw does not immediately grant remote code execution, but it can destabilize the system and potentially open a pathway to elevation of privileges if an attacker can induce the faulty sequence. The vulnerability is catalogued under CWE‑416.

All Linux kernel installations that include the arm‑smmu‑v3 driver, as the flaw resides in the IOPF queue cleanup path of that driver. No specific kernel version numbers are listed, so any kernel build that incorporates this module is potentially affected.

The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalogue, indicating no widespread exploitation evidence as of this analysis. Without an active known exploit, the risk level is moderate: a local or privileged user can trigger the fault by removing or resetting the device while interrupts may still be pending. The primary impact is a denial of service via a kernel crash; the lack of remote trigger or exploitation proof limits immediate threat, but the potential for privilege escalation or denial remains if an attacker can control device teardown. Attack vector is inferred to be local device removal or reset operations, most likely requiring elevated permissions to invoke the vulnerable routine.