HIGH Introduced in 6.4
isst PerfLevelMask OOB
CVE-2026-89443
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI4.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf_levels[] via _read_pp_level_info() and _read_bf_level_info(), but neither helper validates it first. The adjacent level-info helpers reject levels above max_level before reading the same per-level register block. Add the same bounds checks to the mask helpers, and reject disabled SST-PP levels in isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info(). This prevents out-of-bounds reads from the per-level offset table on invalid ioctl input.
02KernelScan AI Analysis
Risk summary
Local users with root access on Intel systems equipped with TPMI-based Speed Select Technology can trigger an out-of-bounds read by supplying an invalid performance level to two ISST ioctl handlers. The invalid index reads garbage from beyond the per-level offset table, which is then used as a hardware register address—potentially leaking hardware register values or causing a kernel panic. The vulnerability requires specific Intel hardware and access to the ISST device node, which is normally restricted to privileged users.
Vulnerability analysis
Two ioctl handlers in the Intel Speed Select Technology TPMI interface accepted a user-supplied performance level value and used it as an array index without first checking it against the maximum supported level. A level beyond the valid range causes the kernel to read from beyond the per-level offset table, using garbage data as a hardware register address that may return sensitive register contents or fault and crash the kernel. The fix adds the same bounds checks already present in the adjacent level-info ioctls, rejecting levels above the maximum and disabled SST-PP levels. This is reachable locally through the ISST device node, which requires root access, and only on Intel hardware with TPMI-based SST support.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 6.4 | 6.6.157 | beb22ebf76c0 |
| 6.12 | 6.4 | 6.12.109 | 1a8bab5ceee1 |
| 6.18 | 6.4 | 6.18.50 | 1889a9156553 |
| mainline | 6.4 | 7.3-rc1 | 80e0d353c86a |
| 7.2 | 6.4 | 7.2.4 | d19385624bdf |
| cip/6.12 | 6.4 | 6.12.111-cip32 | 1a8bab5ceee1 |