CVE-2026-89438: platform/x86: ISST: Validate logical CPU id and clos id
Published Sep 11, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: ISST: Validate logical CPU id and clos id
Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate MMIO offset.
Affected Software
1 affected component
Linux Kernel
Event History
Sep 11, 2026
CVE Published
via MITRE·07:43 PM
Data Sourced
via MITRE·07:43 PM
Description
Frequently Asked Questions
1
What inputs must an attacker control to trigger the issue?
They must be able to supply an out-of-range CLOS level or logical CPU number to the ISST core power feature. Those values are used to calculate an MMIO offset.
2
What is the mitigation if an update cannot be applied immediately?
Avoid invoking the ISST core power feature with CLOS IDs or logical CPU IDs greater than the supported maximum. Ensure any tooling or administrative workflows that use this feature validate these values before issuing requests.