The flaw lies in the Linux kernel’s PowerPC IOMMU driver where the function iommu_tce_check_ioba erroneously ignores the npages argument, assuming a single page. This leads to an unchecked arithmetic overflow when callers provide multiple pages, allowing the calculated address range (ioba - offset + npages) to exceed the actual table capacity. Such an overflow can corrupt kernel memory boundaries or cause arbitrary writes to kernel structures, potentially enabling privilege escalation or denial of service.

All Linux kernel builds that include the PowerPC IOMMU driver, prior to the patch commit b1af23d836f8, are affected. This includes any system running a kernel version that utilizes the IOMMU subsystem for KVM or VFIO on PowerPC platforms.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is below 1 %, meaning exploitation probability is low but non‑zero. The flaw requires local or privileged execution to interact with the IOMMU through KVM or VFIO interfaces before the overflow can be triggered. While no active exploitation is documented and the vulnerability is not listed in CISA’s KEV catalog, the potential impact of arbitrary memory write makes it a high‑risk issue for affected systems.