A high-severity use-after-free vulnerability in the Linux kernel iommufd subsystem could allow a local authenticated attacker to achieve arbitrary code execution or system instability.

The flaw exists due to improper synchronization between the IOMMUFD selftest TRIGGER_IOPF mechanism and the PASID detach process. An attacker with local access can exploit this race condition to dereference a freed memory pointer, resulting in a use-after-free (UAF) condition that enables potential privilege escalation or kernel panic.

The vulnerability carries a CVSS score of 8.8, indicating a high risk of compromise. Because the flaw permits potential arbitrary code execution with kernel-level privileges, it poses a severe threat to system confidentiality, integrity, and availability. Successful exploitation could allow an attacker to bypass security controls, exfiltrate sensitive data, or render critical infrastructure unresponsive.

Immediate Action: Administrators must update their Linux kernel to version 6.18.50, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or panic events, which may indicate attempts to trigger the UAF condition.

Compensating Controls: Ensure that local user access is strictly restricted to authorized personnel, as the attack vector requires local, low-privileged access to the system.

Public Exploit Available: Unknown

Given the potential for kernel-level compromise, this vulnerability should be treated with high urgency. Organizations running affected Linux kernel versions should prioritize testing and deploying the provided security patches across their environment. Failure to patch leaves the underlying operating system susceptible to privilege escalation by local users.