The flaw is in the Linux kernel's AMD IOMMU subsystem where a negative error code from the domain ID allocator is stored in an unsigned 32‑bit variable. The subsequent check compares the unsigned value to zero, causing the test to never trigger. As a result, a nested IOMMU domain is created with a host domain ID that was never allocated, which can lead to the driver accessing memory or devices that should not have been assigned. This is an example of improper sign conversion (CWE‑253).

All instances of the Linux kernel that include the AMD IOMMU driver and use the nested domain allocation path prior to the patch commits 80c231f5577229d1e90a1e312b3095f9502f8625 or fa5c0827f0b7bac6d0a188f10118151769ae68fd are affected. The CVE does not provide specific version ranges, so any kernel build that contains the vulnerable code path is affected.

The CVSS score of 7.8 indicates a high severity vulnerability. Because the flaw involves a simple unchecked integer conversion, the complexity of exploiting it is low. EPSS score of < 1% indicates a very low exploitation probability, making successful exploitation unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local – an attacker needs to trigger nested domain allocation, which normally requires privileged access to the IOMMU subsystem or a kernel module that performs the allocation. An attacker who can exercise the vulnerable code path could cause the driver to set up an invalid host domain ID, leading to memory corruption or a system crash.