GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89443 (GCVE-0-2026-89443)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-14 11:59
VLAI
Title
platform/x86: ISST: Validate level in perf mask ioctls
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf_levels[] via _read_pp_level_info() and _read_bf_level_info(), but neither helper validates it first. The adjacent level-info helpers reject levels above max_level before reading the same per-level register block. Add the same bounds checks to the mask helpers, and reject disabled SST-PP levels in isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info(). This prevents out-of-bounds reads from the per-level offset table on invalid ioctl input.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ea009e4769fa3bd05d4c111c3b6865eb3a9be829 , < beb22ebf76c0415f22d2d0c3f1ff0627e7ae4a68 (git)
Affected: ea009e4769fa3bd05d4c111c3b6865eb3a9be829 , < 1a8bab5ceee1a42a78de12d3d69f67516a20588e (git)
Affected: ea009e4769fa3bd05d4c111c3b6865eb3a9be829 , < 1889a9156553f0692acd57caf15e877baace1a01 (git)
Affected: ea009e4769fa3bd05d4c111c3b6865eb3a9be829 , < d19385624bdfb577db9c94bb8879992fd5e17bcd (git)
Affected: ea009e4769fa3bd05d4c111c3b6865eb3a9be829 , < 80e0d353c86a9a168ad6d213f494796294381538 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "beb22ebf76c0415f22d2d0c3f1ff0627e7ae4a68",
              "status": "affected",
              "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
              "versionType": "git"
            },
            {
              "lessThan": "1a8bab5ceee1a42a78de12d3d69f67516a20588e",
              "status": "affected",
              "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
              "versionType": "git"
            },
            {
              "lessThan": "1889a9156553f0692acd57caf15e877baace1a01",
              "status": "affected",
              "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
              "versionType": "git"
            },
            {
              "lessThan": "d19385624bdfb577db9c94bb8879992fd5e17bcd",
              "status": "affected",
              "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
              "versionType": "git"
            },
            {
              "lessThan": "80e0d353c86a9a168ad6d213f494796294381538",
              "status": "affected",
              "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Validate level in perf mask ioctls\n\nisst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the\nuser-provided level as an index into perf_levels[] via\n_read_pp_level_info() and _read_bf_level_info(), but neither helper\nvalidates it first.\n\nThe adjacent level-info helpers reject levels above max_level before\nreading the same per-level register block. Add the same bounds checks to\nthe mask helpers, and reject disabled SST-PP levels in\nisst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().\n\nThis prevents out-of-bounds reads from the per-level offset table on\ninvalid ioctl input."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local ioctl(ISST_IF_GET_PERF_LEVEL_CPU_MASK or ISST_IF_GET_BASE_FREQ_CPU_MASK) on /dev/isst_interface, dispatched through isst_if_def_ioctl() to the TPMI SST helpers; there is no network, Bluetooth, or physical-device path into these functions.\nAC:L - The attacker fully controls the ioctl argument, including the 8-bit level used as perf_levels[level] with no pre-fix bounds check; the out-of-bounds table read and following MMIO readq() occur deterministically, with no race or attacker-uncontrollable memory layout required.\nPR:L - isst_if_open() and both GET mask ioctls perform no capable() check; CAP_SYS_ADMIN is required only for SST write/set commands, so a local process that can open /dev/isst_interface can reach this read path without init-namespace admin capabilities.\nUI:N - The attacker opens /dev/isst_interface and issues the crafted ioctl from their own process; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The out-of-bounds kernel/MMIO read and any resulting oops stay within the host kernel security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - User-supplied level (0-255) indexes perf_levels[] (at most 8 entries), reading adjacent heap as a signed mmio_offset that is then used in readq(); the 64-bit result is copied to userspace when punit_cpu_map is set, an out-of-bounds read rated High unless strictly a few bytes.\nI:N - Both helpers only issue MMIO readq() and copy_to_user of the resulting mask; there is no writeq, heap write, type confusion, or control-flow hijack primitive on this path.\nA:H - sst_base is a bounded ioremap from devm_ioremap_resource(); a heap-derived mmio_offset can drive readq() outside that mapping and oops, and the perf_levels[] over-read itself can fault on hardened kernels; any kernel crash is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:53.518Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/beb22ebf76c0415f22d2d0c3f1ff0627e7ae4a68"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a8bab5ceee1a42a78de12d3d69f67516a20588e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1889a9156553f0692acd57caf15e877baace1a01"
        },
        {
          "url": "https://git.kernel.org/stable/c/d19385624bdfb577db9c94bb8879992fd5e17bcd"
        },
        {
          "url": "https://git.kernel.org/stable/c/80e0d353c86a9a168ad6d213f494796294381538"
        }
      ],
      "title": "platform/x86: ISST: Validate level in perf mask ioctls",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89443",
    "datePublished": "2026-09-11T19:43:11.407Z",
    "dateReserved": "2026-09-11T19:38:34.704Z",
    "dateUpdated": "2026-09-14T11:59:53.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89443",
      "date": "2026-09-18",
      "epss": "0.00159",
      "percentile": "0.0547"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "beb22ebf76c0415f22d2d0c3f1ff0627e7ae4a68",
                    "status": "affected",
                    "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1a8bab5ceee1a42a78de12d3d69f67516a20588e",
                    "status": "affected",
                    "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1889a9156553f0692acd57caf15e877baace1a01",
                    "status": "affected",
                    "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d19385624bdfb577db9c94bb8879992fd5e17bcd",
                    "status": "affected",
                    "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "80e0d353c86a9a168ad6d213f494796294381538",
                    "status": "affected",
                    "version": "ea009e4769fa3bd05d4c111c3b6865eb3a9be829",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/platform/x86/intel/speed_select_if/isst_tpmi_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Validate level in perf mask ioctls\n\nisst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the\nuser-provided level as an index into perf_levels[] via\n_read_pp_level_info() and _read_bf_level_info(), but neither helper\nvalidates it first.\n\nThe adjacent level-info helpers reject levels above max_level before\nreading the same per-level register block. Add the same bounds checks to\nthe mask helpers, and reject disabled SST-PP levels in\nisst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().\n\nThis prevents out-of-bounds reads from the per-level offset table on\ninvalid ioctl input."
          }
        ],
        "id": "CVE-2026-89443",
        "lastModified": "2026-09-14T13:19:01.547",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:24.737",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1889a9156553f0692acd57caf15e877baace1a01"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1a8bab5ceee1a42a78de12d3d69f67516a20588e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/80e0d353c86a9a168ad6d213f494796294381538"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/beb22ebf76c0415f22d2d0c3f1ff0627e7ae4a68"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d19385624bdfb577db9c94bb8879992fd5e17bcd"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T21:49:29+00:00",
      "cve": "CVE-2026-89443",
      "id": "CVE-2026-89443",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: platform/x86: ISST: Validate level in perf mask ioctls",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89443.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T00:59:19Z",
      "cve": "CVE-2026-89443",
      "id": "CVE-2026-89443",
      "initial_release_date": "2026-09-12T16:28:24Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "323",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89443",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89443.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.