CVE-2026-89442

Received Received - Intake

Buffer Overflow in Linux Kernel platform/x86 ISST

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in clos_assoc ioctl isst_if_clos_assoc() validates the user-supplied socket_id with 'socket_id > topology_max_packages()', but isst_common.sst_inst[] is allocated with topology_max_packages() entries, so the valid index range is [0, topology_max_packages()). The '>' comparison lets socket_id == topology_max_packages() pass and index one entry past the array. In addition, isst_common.sst_inst[socket_id] is NULL for an in-range package that has no bound TPMI SST instance, and the pointer is used without a NULL check. Both the out-of-bounds entry and the NULL pointer are then dereferenced by map_partition_power_domain_id() and the following power_domain_info access. Reject socket_id >= topology_max_packages() and a NULL sst_inst, matching the checks already performed by get_instance().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89442

EUVD

EUVD-2026-76348

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of the socket_id parameter in the clos_assoc ioctl function. The function checks if socket_id is greater than topology_max_packages() but fails to prevent socket_id from equaling topology_max_packages(), leading to an out-of-bounds array access. Additionally, it does not check if isst_common.sst_inst[socket_id] is NULL before dereferencing it, causing potential NULL pointer dereferences.

Detection Guidance

This vulnerability is specific to the Linux kernel's ISST (Intel Speed Select Technology) module. Detection requires checking kernel logs for errors related to socket_id validation or NULL pointer dereferences in ISST operations. Use commands like 'dmesg | grep -i isst' or 'journalctl -k | grep -i isst' to inspect kernel logs for suspicious activity.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a denial-of-service (DoS) condition or potentially execute arbitrary code in the kernel. It may lead to system crashes, privilege escalation, or unauthorized access to sensitive data depending on the kernel's behavior when accessing invalid memory.

Compliance Impact

This vulnerability is a kernel-level issue in the Linux operating system related to improper validation of socket IDs in the ISST module. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than low-level system vulnerabilities.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. If immediate patching is not possible, disable the ISST module by adding 'modprobe.blacklist=isst' to kernel boot parameters or unloading the module with 'rmmod isst'. Monitor system logs for any signs of exploitation.

Hi! I’m here to help you understand CVE-2026-89442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70