CVE-2026-89442platform/x86: ISST: Validate socket ID in clos_assoc ioctl
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in clos_assoc ioctl isst_if_clos_assoc() validates the user-supplied socket_id with 'socket_id > topology_max_packages()', but isst_common.sst_inst[] is allocated with topology_max_packages() entries, so the valid index range is [0, topology_max_packages()). The '>' comparison lets socket_id == topology_max_packages() pass and index one entry past the array. In addition, isst_common.sst_inst[socket_id] is NULL for an in-range package that has no bound TPMI SST instance, and the pointer is used without a NULL check. Both the out-of-bounds entry and the NULL pointer are then dereferenced by map_partition_power_domain_id() and the following power_domain_info access. Reject socket_id >= topology_max_packages() and a NULL sst_inst, matching the checks already performed by get_instance().
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 12a7d2cb811dd8a884dea088a2701fcb8d00136e before c847ea4851ecfa3462cc711ded2c3c3dd8d08ab8; 12a7d2cb811dd8a884dea088a2701fcb8d00136e builds before 0d90ab5f80e19cddfeb0c9fab47a1f34aa932075; from 12a7d2cb811dd8a884dea088a2701fcb8d00136e before 82e707eff9e3b7ef6d96ecc23ea8876d20c7d6ca; from 12a7d2cb811dd8a884dea088a2701fcb8d00136e before 207b4dc6eb100141b122b2602504a1429a4b6558; from 12a7d2cb811dd8a884dea088a2701fcb8d00136e before a89f07db0cb95c54dac4a8406c79a04e44a73c3c | CNA record |
References
- https://git.kernel.org/stable/c/c847ea4851ecfa3462cc711ded2c3c3dd8d08ab8
- https://git.kernel.org/stable/c/0d90ab5f80e19cddfeb0c9fab47a1f34aa932075
- https://git.kernel.org/stable/c/82e707eff9e3b7ef6d96ecc23ea8876d20c7d6ca
- https://git.kernel.org/stable/c/207b4dc6eb100141b122b2602504a1429a4b6558
- https://git.kernel.org/stable/c/a89f07db0cb95c54dac4a8406c79a04e44a73c3c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.