The Linux kernel's iommufd_hwpt_invalidate() function accepted user-controlled entry_num and entry_len parameters, each only bounded by U32_MAX. An entry_len larger than the kernel's expected struct size caused the kernel to verify extra bytes in a single uninterruptible pass, which could be multi-gigabyte in size if user memory was zeroed, triggering the soft-lockup watchdog. Similarly, a large entry_num drove a backend invalidation loop without rescheduling, causing CPU pinning on a non-preemptible kernel path. The fix caps entry_len under PAGE_SIZE and entry_num under 1 << 19, limiting the loop length and preventing excessive CPU blocking.

Exploitation of this vulnerability could cause a denial of service by triggering a soft-lockup condition or CPU pinning in the kernel, leading to system unresponsiveness. There is no indication of privilege escalation or data corruption from the provided information.

A fix has been implemented in the Linux kernel to impose upper bounds on the entry_num and entry_len parameters in the iommufd ioctl, preventing excessive resource consumption and CPU pinning. Users should update to a kernel version that includes this fix once available. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.