CVE-2026-89443

The Linux kernel's Intel Speed Select Technology (ISST) interface driver accepts a user-supplied 'level' value in the isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() ioctls and uses it directly as an index into the per-level perf_levels[] offset table, without the bounds checks that the adjacent level-info helpers already perform. A local attacker with low privileges triggers the flaw by issuing these ioctls with an out-of-range (or, for the perf-level mask, disabled) SST-PP level. The result is an out-of-bounds kernel read, yielding information disclosure and potential denial of service on the affected machine (CVSS 3.1: 7.1, local vector, C:H/I:N/A:H). Affected systems are those running a kernel with the unfixed ISST interface code active on Intel SST-PP-capable hardware, chiefly Xeon Scalable servers. No public proof of concept or in-the-wild exploitation is known, and the issue is not on the CISA KEV list.

What to do: Update to a kernel that includes the upstream ISST fix (the patch adds level bounds checks to both mask ioctls and rejects disabled SST-PP levels); on distribution-maintained kernels, apply the backported fix when it ships. On servers that do not use Intel Speed Select Technology, consider blacklisting or not loading the intel_speed_select_if / isst_if modules. As defense in depth, confirm that access to the ISST interface device node is limited to trusted accounts on multi-user Xeon hosts.