The vulnerability originates from a missing null check in the iova_to_phys() routine when a 5 level translation table of type ZPCI_TABLE_TYPE_RFX is used. When the mapping is missing, an intermediate pointer becomes null and the code dereferences it, causing a kernel crash. The result is a denial of service that can affect any process with the ability to invoke the function, potentially leading to a system reboot or unavailability. This flaw does not provide code execution, but it can be exploited locally to bring down a service.

All Linux kernel releases that support the ZPCI_TABLE_TYPE_RFX 5 level translation table are impacted until the patch is applied. The fix has been committed in the upstream kernel; the relevant kernel revisions can be referenced via the supplied Git links. Any distribution that ships a kernel prior to these commits is considered vulnerable.

The CVSS score of 5.5 indicates a moderate severity flaw in kernel code, while the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread public exploitation. Exploitation would require triggering iova_to_phys() with an unmapped IOVA address. The CVE description does not specify the exact privilege level or API required, but because the function operates in kernel space it is inferred that local or privileged access is needed. A local attacker could bring down the system, but the impact is confined to the affected host.