The bug stems from the function that allocates an IOMMU domain ID converting a negative error code into an unsigned 32‑bit value. When the ID pool is exhausted, the allocation returns -ENOSPC, but the code stores it into an unsigned variable and then tests the value after the conversion. Because the test never fires, a domain is created with a host ID that was never properly allocated, potentially allowing the nested domain to access or corrupt memory it should not, leading to privilege escalation or denial of service.

Affected products are all instances of the Linux kernel that include the AMD IOMMU subsystem before the patch commit. The kernel versions prior to the inclusion of the commits linked in the references are vulnerable. The vulnerability is not limited to a specific kernel release series, so any deployment using the affected code path is at risk.

The CVSS score for this vulnerability is not provided, but the complexity of exploitation is low: an attacker with the ability to trigger nested domain allocation can observe the reuse of an unallocated host ID. The EPSS score is not available, so exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; however, an attacker who can influence domain allocation through privileged interfaces may leverage the flaw to gain higher privileges or cause a system crash.