The Linux kernel's accel/qaic driver had a vulnerability where the remap_pfn_range call in qaic_gem_object_mmap could remap memory beyond the bounds of the VMA if the buffer object was oversized. This could lead to use-after-free issues because munmap() would unmap only the VMA region, leaving additional mappings intact and potentially accessible. The vulnerability was addressed by adding an overflow check to ensure the remapped length does not exceed the VMA size, truncating it if sg->length is too large.

The vulnerability could cause use-after-free conditions in kernel memory management related to mmap operations in the accel/qaic driver. This may lead to memory corruption or stability issues in affected systems. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel by adding an overflow check to remap_pfn_range during mmap in the accel/qaic driver. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.