Executive brief
The Linux kernel's Intel Speed Select Technology (ISST) driver contains input validation flaws in two ioctl handlers that manage processor performance settings. An attacker with local access can supply invalid performance levels to trigger out-of-bounds memory reads, potentially exposing kernel memory contents or causing a denial of service.
Technical details
The vulnerability exists in isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() functions in the ISST platform/x86 driver. These functions accept a user-supplied level parameter via ioctl and use it as an array index into perf_levels[] without validating it against max_level bounds first. Additionally, isst_if_get_perf_level_mask() fails to check whether the requested SST-PP level is enabled. The fix adds bounds checks and level-enabled validation before reading per-level register blocks, preventing out-of-bounds array access. Attack vector requires local execution access to issue ioctls (e.g., privileged user process). Patches have been merged into the mainline Linux kernel.
Affected products
- Linux Linux kernel 5.18.y and later (when ISST TPMI support was introduced)
Timeline
- 2026-09-11: disclosed: CVE-2026-89443 published
- 2026-09-07: patched: Patch merged into stable Linux kernel trees