Executive brief
The Linux kernel's Intel Speed Select Technology (ISST) driver failed to validate that a socket-specific data structure was successfully loaded before accessing it. An attacker with local access could trigger a NULL pointer dereference, causing a denial of service or system crash.
Technical details
This vulnerability is a NULL pointer dereference in the ISST (Intel Speed Select Technology) driver within drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c. The function isst_if_get_tpmi_instance_count() retrieves a socket instance from isst_common.sst_inst[] without checking if the pointer is NULL, which can occur when socket loading fails. An attacker with local kernel access (e.g., via a privileged ioctl call) can trigger this code path and dereference the NULL pointer, leading to a kernel panic. The fix adds a simple NULL check that returns -EINVAL if the socket instance is not available. No CVSS score was assigned by the reporter.
Affected products
- Linux Linux kernel multiple versions (patched in 2026-08-11)
Timeline
- 2026-09-11: disclosed: CVE-2026-89439 published
- 2026-08-11: patched: Fix committed upstream