Executive brief
The Linux kernel's Intel Speed Select Technology (ISST) platform driver failed to properly validate CPU and performance class identifiers before using them to calculate memory-mapped I/O (MMIO) offsets. This missing validation could allow attackers to trigger out-of-bounds memory access, potentially causing kernel crashes or data corruption on systems with Intel processors.
Technical details
The vulnerability exists in the platform/x86/intel/speed_select_if/isst_tpmi_core.c driver, specifically in the isst_if_clos_param() and isst_if_clos_assoc() functions. These functions accepted user-supplied logical CPU IDs and CLOS (Class of Service) level parameters without validating them against their maximum supported values (CLOS ≤ 3, logical CPU ≤ 63). Since these parameters are directly used to calculate MMIO offsets for the core power feature, invalid values could lead to out-of-bounds memory operations. The fix adds explicit bounds checks that reject any CLOS level or logical CPU number exceeding the supported maximum, returning -EINVAL for invalid inputs. The vulnerability affects kernel versions from 5.15 onwards where the SST-CP (Speed Select Technology - Core Power) feature via TPMI was introduced.
Affected products
- Linux Linux kernel 5.15 and later (up to 6.1, 6.10, and other stable branches)
Timeline
- 2026-09-11: disclosed
- 2026-08-11: patched: Upstream commit 124e2dbabe460c2a6e7440f4ad8af560131295c9 authored by Srinivas Pandruvada