The vulnerability in the Linux kernel's swiotlb subsystem arises because swiotlb_alloc_tlb() may allocate from the DMA atomic pool when a decrypted pool is needed in atomic context. With CONFIG_DMA_DIRECT_REMAP enabled, the atomic pool uses remapped virtual addresses differing from direct-map addresses returned by phys_to_virt(). The function swiotlb_init_io_tlb_pool() reconstructs the pool virtual address from the physical start address, which is incorrect for atomic-pool backed allocations, causing pool->vaddr to store a wrong address. Consequently, swiotlb_free_tlb() passes this incorrect address to dma_free_from_pool(), which fails to recognize the chunk, potentially leading to memory management issues. The fix involves passing the virtual address returned by the allocation path into swiotlb_init_io_tlb_pool() and storing it in pool->vaddr, ensuring consistency between allocation and free paths.

This vulnerability can cause improper memory management in the Linux kernel's swiotlb subsystem, potentially leading to failures in freeing allocated DMA buffers. The CVSS score of 7.8 with high confidentiality, integrity, and availability impacts indicates that exploitation could result in significant system compromise or denial of service. However, no known exploits are reported in the wild at this time.

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch to resolve the issue. Since this is a kernel-level vulnerability, upgrading to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update instructions.