HIGH Introduced in 6.4 Published 2026-09-11

isst ClosAssoc OOB

CVE-2026-89442

CVSS 7.8 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

KernelScan AI4.7MEDIUM

01Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in clos_assoc ioctl isst_if_clos_assoc() validates the user-supplied socket_id with 'socket_id > topology_max_packages()', but isst_common.sst_inst[] is allocated with topology_max_packages() entries, so the valid index range is [0, topology_max_packages()). The '>' comparison lets socket_id == topology_max_packages() pass and index one entry past the array. In addition, isst_common.sst_inst[socket_id] is NULL for an in-range package that has no bound TPMI SST instance, and the pointer is used without a NULL check. Both the out-of-bounds entry and the NULL pointer are then dereferenced by map_partition_power_domain_id() and the following power_domain_info access. Reject socket_id >= topology_max_packages() and a NULL sst_inst, matching the checks already performed by get_instance().

02KernelScan AI Analysis

Engine v0.6.0

Risk summary

A local attacker with root privileges on Intel hardware supporting TPMI-based Speed Select Technology can trigger a kernel panic by supplying a crafted socket ID to a CLOS association ioctl. The bug is an off-by-one bounds check that allows reading one entry past an internal array, plus a missing NULL check on unpopulated socket entries. The impact is denial of service via kernel crash.

Affecteddrivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c (Intel Speed Select Technology TPMI Core)

Vulnerability analysis

The Intel Speed Select Technology TPMI core driver validates a user-supplied socket ID in a CLOS association ioctl using an off-by-one comparison, allowing an index one past the end of the internal instance array to be read. The resulting out-of-bounds pointer—and also a legitimate but NULL pointer for sockets without a bound SST instance—is dereferenced without a check, causing a kernel crash. The fix corrects the bounds comparison to reject the boundary value and adds a NULL check on the retrieved instance pointer before any dereference, matching validation already done elsewhere in the driver. This path is reachable locally through the ISST device interface, which requires root-level access and Intel hardware with TPMI SST support.

03Fix Versions

Branch	Introduced	Fixed in	Patch commit
6.12	6.4	6.12.109	`0d90ab5f80e1`
6.18	6.4	6.18.50	`82e707eff9e3`
6.6	6.4	6.6.157	`c847ea4851ec`
7.2	6.4	7.2.4	`207b4dc6eb10`
mainline	6.4	7.3	`a89f07db0cb9`
cip/6.12	6.4	6.12.111-cip32	`0d90ab5f80e1`

04CIP Kernels

State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.

CIP tree	State
cip/6.12	Fixed in 6.12.111-cip32