CVE-2026-89443: platform/x86: ISST: Validate level in perf mask ioctls
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: ISST: Validate level in perf mask ioctls
isstifgetperflevelmask() and isstifgetbasefreqmask() use the user-provided level as an index into perflevels[] via readpplevelinfo() and readbflevelinfo(), but neither helper validates it first.
The adjacent level-info helpers reject levels above maxlevel before reading the same per-level register block. Add the same bounds checks to the mask helpers, and reject disabled SST-PP levels in isstifgetperflevelmask() to match isstifgetperflevelinfo().
This prevents out-of-bounds reads from the per-level offset table on invalid ioctl input.
Affected Software
Event History
Frequently Asked Questions
What access would an attacker need to trigger this issue?
An attacker would need to supply an invalid level value through the affected ISST performance-mask ioctl interface. The vulnerability is triggered by user-controlled ioctl input being used as an unchecked index.
Which systems are exposed?
Exposure is limited to Linux systems using the platform/x86 ISST interface and the affected performance-mask ioctls. The provided information does not identify specific processor models, kernel versions, or default enablement conditions.
What behavior indicates an attempted or successful trigger?
The issue involves invalid ioctl level values causing out-of-bounds reads from a per-level offset table. The provided information does not specify logs, error messages, crashes, or other observable indicators.
What mitigation is available if an update cannot be applied immediately?
Restrict access to the affected ISST ioctl interface so untrusted users cannot submit ioctl requests. The vulnerability depends on user-provided invalid level input.