CVE-2026-89443

A flaw was found in the Linux kernel's platform/x86 ISST module. The isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() functions fail to validate a user-provided 'level' parameter. A local attacker could exploit this by providing an invalid 'level' value, leading to an out-of-bounds read from the per-level offset table. This could result in information disclosure or a denial of service (DoS).

A moderate-severity out-of-bounds read flaw exists in the Linux kernel's Intel Speed Select Technology (ISST) TPMI interface driver (drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c), affecting the kernel and kernel-rt packages in several Red Hat Enterprise Linux 9 and 10 update streams and the Red Hat Enterprise Linux CoreOS 9 kernels shipped with OpenShift Container Platform 4.16 and later. The isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() ioctl handlers use a user-supplied performance level value as an index into the per-level register offset table without first validating it against the maximum supported level. A local attacker with low privileges could exploit this flaw by issuing an ISST ioctl with an out-of-range level value, triggering an out-of-bounds read from kernel memory that could result in information disclosure or a denial of service (system crash or instability).

Older Red Hat Enterprise Linux streams, including RHEL 6, 7, and 8 and the RHEL 9.2 streams, as well as OpenShift Container Platform 4.12 through 4.15, are not affected because the vulnerable code is not present in those kernels.

For the affected products the fix is currently deferred: Red Hat rates this flaw MODERATE with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), below the threshold at which Red Hat files trackers and schedules updates for flaws of this severity, so the residual risk remains that an authenticated local user could trigger an out-of-bounds read that crashes the system or exposes kernel memory contents. This differs from the CVE.org severity of 7.1 (IMPORTANT), which scores the confidentiality impact of the out-of-bounds read as high; Red Hat's assessment instead weights the primary practical consequence of this local, low-privilege flaw as availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.