CVE-2026-89438: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89438 Overview

CVE-2026-89438 affects the Linux kernel's Intel Speed Select Technology (ISST) driver under platform/x86. The driver failed to validate the maximum Class of Service (CLOS) identifier and the logical CPU identifier used by the core power feature. These values are used to calculate Memory-Mapped I/O (MMIO) offsets. Without proper bounds checking, an out-of-range CLOS level or logical CPU number can cause the driver to compute invalid MMIO offsets. The upstream fix adds explicit validation and rejects values that exceed the supported maximum.

Critical Impact
Missing input validation on CLOS and logical CPU identifiers allows out-of-bounds MMIO offset calculation in the ISST core power feature path.

Affected Products

Linux kernel platform/x86 ISST driver
Distributions shipping affected stable kernel branches prior to the referenced fix commits
Intel platforms exposing the ISST core power feature interface

Discovery Timeline

2026-09-11 - CVE-2026-89438 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89438

Vulnerability Analysis

The Intel Speed Select Technology (ISST) driver exposes controls for per-core power features, including CLOS assignments per logical CPU. The driver uses the CLOS identifier and the logical CPU identifier to compute an MMIO register offset. Before the fix, the code path did not verify that either value was within the maximum supported by the platform. An identifier greater than the supported maximum caused the offset calculation to reference memory outside the intended MMIO window. This is an [CWE-20] improper input validation issue with characteristics of an out-of-bounds access primitive in a kernel driver.

Root Cause

The root cause is missing range checks on two attacker-controlled inputs: the CLOS level and the logical CPU number. Both values feed directly into arithmetic that produces an MMIO offset. Without validation, the driver trusts caller-supplied identifiers and dereferences the resulting offset.

Attack Vector

Exploitation requires local access to the ISST interface exposed by the kernel. A caller able to invoke the affected core power feature path can supply out-of-range CLOS or logical CPU identifiers. The impact depends on what the resulting MMIO offset maps to on the target platform. NVD has not published a CVSS vector for this entry, and no public exploit is listed.

No verified proof-of-concept code is available. See the upstream fix commits referenced below for the exact validation logic added: Kernel Fix Commit 0d60112, Kernel Fix Commit 124e2db, Kernel Fix Commit 5b032e1, Kernel Fix Commit 82d4afa, and Kernel Fix Commit c9ee277.

Detection Methods for CVE-2026-89438

Indicators of Compromise

Unexpected kernel log entries from the ISST driver referencing invalid CLOS or CPU identifiers
Kernel oops or warnings originating in platform/x86 ISST code paths
Unprivileged or unexpected processes issuing ISST ioctl or sysfs writes on Intel server platforms

Detection Strategies

Inventory running kernel versions against the fixed commits and flag hosts on unpatched stable branches
Audit access to ISST control interfaces exposed under /dev and /sys on Intel platforms
Correlate kernel ring buffer messages with process ancestry to identify callers issuing anomalous CLOS or CPU values

Monitoring Recommendations

Forward dmesg and journald kernel facility logs to a central analytics tier for anomaly review
Alert on new local processes interacting with ISST interfaces outside of known administrative tooling
Track kernel package versions across the fleet and generate deviation alerts when hosts fall behind upstream stable releases

How to Mitigate CVE-2026-89438

Immediate Actions Required

Apply the vendor kernel update containing the referenced ISST validation commits
Restrict local access to ISST control interfaces to trusted administrative users only
Identify Intel platforms where ISST is enabled and prioritize patching those hosts first

Patch Information

The fix adds explicit maximum-bound validation for CLOS ID and logical CPU ID before they are used in MMIO offset calculation. Any value greater than the supported maximum is rejected. The change is present in the following upstream stable commits: 0d601126, 124e2dba, 5b032e1d, 82d4afad, and c9ee2770. Upgrade to a distribution kernel that includes the corresponding backport.

Workarounds

Unload the ISST driver module on systems that do not require Intel Speed Select functionality
Constrain filesystem permissions on ISST control nodes so only privileged administrators can issue requests
Disable ISST in platform firmware where the feature is not used operationally

bash

# Check running kernel and ISST module status
uname -r
lsmod | grep -i isst

# Temporarily unload the ISST driver where the feature is not required
sudo modprobe -r isst_if_mbox_msr isst_if_mbox_pci isst_if_common 2>/dev/null

# Prevent auto-load until the patched kernel is installed
echo 'blacklist isst_if_common' | sudo tee /etc/modprobe.d/isst-blacklist.conf