CVE-2026-89442

A flaw was found in the Linux kernel. The isst_if_clos_assoc ioctl function in the platform/x86: ISST module contains an improper validation of the socket_id. This allows a local attacker to cause an out-of-bounds access or a NULL pointer dereference. This could lead to a system crash, resulting in a Denial of Service (DoS).

A MODERATE severity flaw was found in the Linux kernel platform/x86 Intel Speed Select Technology (ISST) driver. The isst_if_clos_assoc() ioctl validated the user-supplied socket_id using 'socket_id > topology_max_packages()', but the isst_common.sst_inst[] array holds exactly topology_max_packages() entries, so a socket_id equal to topology_max_packages() passes the check and indexes one entry past the end of the array. In addition, for an in-range package with no bound TPMI SST instance, sst_inst[socket_id] is NULL and was used without a NULL check. A local attacker with access to the ISST ioctl interface could exploit this to trigger an out-of-bounds access or a NULL pointer dereference in map_partition_power_domain_id(), causing a kernel panic and a denial of service. No confidentiality or integrity impact is expected.

Red Hat Product Security rates this flaw MODERATE (CVSS 3.1 score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges to reach the platform-specific ISST interface and the impact is limited to availability. This differs from the upstream CVE record, which scores the issue 7.8 (HIGH) with high confidentiality and integrity impact; the available technical evidence supports only a system crash/DoS consequence.

The vulnerable code is present in Red Hat Enterprise Linux 9 (kernel and kernel-rt) and Red Hat Enterprise Linux 10, and in OpenShift Container Platform 4.16 and later releases through the RHEL CoreOS 9 kernel. For these affected products the fix is currently deferred: the flaw is MODERATE severity with a CVSS score below the threshold at which Red Hat files errata trackers, so the fix will be delivered in a future scheduled update, and the residual risk is a local denial of service on systems with affected Intel SST TPMI hardware. Red Hat Enterprise Linux 6, 7, and 8, RHEL 9.2, and OpenShift Container Platform 4.12 through 4.15 are not affected because the vulnerable code is not present in those streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.