CVE-2026-89443: platform/x86: ISST: Validate level in perf mask ioctls
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: ISST: Validate level in perf mask ioctls
isstifgetperflevelmask() and isstifgetbasefreqmask() use the user-provided level as an index into perflevels[] via readpplevelinfo() and readbflevelinfo(), but neither helper validates it first.
The adjacent level-info helpers reject levels above maxlevel before reading the same per-level register block. Add the same bounds checks to the mask helpers, and reject disabled SST-PP levels in isstifgetperflevelmask() to match isstifgetperflevelinfo().
This prevents out-of-bounds reads from the per-level offset table on invalid ioctl input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add bounds checks to _read_pp_level_info() and _read_bf_level_info() before indexing perf_levels[] in isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask(), and reject disabled SST-PP levels in isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().
Event History
Frequently Asked Questions
What access would an attacker need to trigger this issue?
An attacker would need to supply an invalid level value through the affected ISST performance-mask ioctl interface. The vulnerability is triggered by user-controlled ioctl input being used as an unchecked index.
Which systems are exposed?
Exposure is limited to Linux systems using the platform/x86 ISST interface and the affected performance-mask ioctls. The provided information does not identify specific processor models, kernel versions, or default enablement conditions.
What behavior indicates an attempted or successful trigger?
The issue involves invalid ioctl level values causing out-of-bounds reads from a per-level offset table. The provided information does not specify logs, error messages, crashes, or other observable indicators.
What mitigation is available if an update cannot be applied immediately?
Restrict access to the affected ISST ioctl interface so untrusted users cannot submit ioctl requests. The vulnerability depends on user-provided invalid level input.