CVE-2026-89442

The Linux kernel's Intel Speed Select Technology (ISST) interface driver validates the user-supplied socket_id in the isst_if_clos_assoc() ioctl with a '>' comparison against topology_max_packages(), even though sst_inst[] is allocated with exactly that many entries, so a socket_id equal to topology_max_packages() indexes one element past the end of the array. Separately, an in-range socket_id whose sst_inst[] entry is NULL (a package with no bound TPMI SST instance) is dereferenced without a NULL check. A local attacker with low privileges who can open the ISST character device can pass such a socket_id, causing an out-of-bounds or NULL kernel pointer dereference in map_partition_power_domain_id() and the following power_domain_info access, which can crash the kernel or potentially corrupt kernel memory (CVSS 3.1 7.8, with high impact on confidentiality, integrity, and availability). Affected systems are Linux hosts running kernel code containing the pre-fix ISST TPMI interface implementation, i.e., Intel Xeon server platforms that expose Speed Select Technology via TPMI. No public proof of concept is known and the issue is not in CISA's KEV catalog.

What to do: Update to a kernel release that includes the upstream fix, which rejects socket_id >= topology_max_packages() and NULL sst_inst entries (mirroring get_instance()). Until patched, restrict access to the ISST character device (e.g., /dev/isst_interface) to root via udev rules or file permissions, and audit local unprivileged accounts on SST-capable Xeon hosts. No internet-facing exposure exists, so remediation can follow normal patching cycles.