CVE-2026-89442: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89442 Overview

CVE-2026-89442 is a Linux kernel vulnerability in the Intel Speed Select Technology (ISST) platform driver at platform/x86: ISST. The isst_if_clos_assoc() function performs an off-by-one validation on a user-supplied socket_id and also dereferences a potentially NULL sst_inst[] entry. A local user with access to the ISST ioctl interface can trigger an out-of-bounds read or a NULL pointer dereference in kernel context. This affects kernel stability and can be leveraged to escalate local privileges on affected systems.

Critical Impact
Local attackers can trigger kernel-mode out-of-bounds access or NULL pointer dereference through the ISST clos_assoc ioctl, threatening confidentiality, integrity, and availability of the host.

Affected Products

Linux kernel branches containing the platform/x86 ISST driver prior to the fix commits
Systems exposing the Intel Speed Select Technology ioctl interface (/dev/isst_interface)
Distributions shipping stable kernels before backports of commits 0d90ab5, 207b4dc, 82e707e, a89f07d, and c847ea4

Discovery Timeline

2026-09-11 - CVE-2026-89442 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89442

Vulnerability Analysis

The defect resides in isst_if_clos_assoc() inside the Intel Speed Select Technology (ISST) platform driver. The function validates the user-supplied socket_id with the comparison socket_id > topology_max_packages(). The backing array isst_common.sst_inst[] is allocated with topology_max_packages() entries, giving a valid index range of [0, topology_max_packages()).

The strict-greater-than comparison lets socket_id == topology_max_packages() pass validation. The driver then indexes one entry past the end of the array. Separately, isst_common.sst_inst[socket_id] may be NULL for a package that has no bound Topology Aware Register and PM Capsule Interface (TPMI) SST instance. The pointer is consumed without a NULL check.

Both the out-of-bounds entry and the NULL pointer are subsequently dereferenced by map_partition_power_domain_id() and the following power_domain_info access, corrupting kernel state or crashing the host.

Root Cause

The root cause is an incorrect boundary check combined with a missing NULL guard. The bounds test should use >= rather than > to match the array's zero-based indexing. The code also assumes that every in-range socket has a bound TPMI SST instance, which is not guaranteed. The fix rejects socket_id >= topology_max_packages() and rejects a NULL sst_inst, matching the checks already performed by get_instance().

Attack Vector

Exploitation requires local access to the host and the ability to open and issue ioctls against the ISST character device. An attacker crafts a clos_assoc ioctl payload with socket_id set to topology_max_packages() or to a valid socket index whose corresponding sst_inst[] entry is NULL. The kernel then dereferences invalid memory during map_partition_power_domain_id(), producing a crash or memory disclosure that can support further privilege escalation.

No verified public exploit code is available. Refer to the upstream fix commits for the corrected validation logic: Kernel Commit 0d90ab5 and Kernel Commit c847ea4.

Detection Methods for CVE-2026-89442

Indicators of Compromise

Kernel oops or panic traces referencing isst_if_clos_assoc, map_partition_power_domain_id, or power_domain_info in dmesg and /var/log/kern.log.
Unexpected processes opening /dev/isst_interface or issuing ISST ioctls outside of known management tooling such as intel-speed-select.
Repeated segmentation faults or crashes originating from user processes interacting with the platform/x86 ISST driver.

Detection Strategies

Audit ioctl syscalls against the ISST character device using auditd rules keyed on the device inode or path.
Instrument eBPF probes on isst_if_clos_assoc() to log calling PID, UID, and the supplied socket_id value for out-of-range detection.
Correlate kernel crash telemetry with process ancestry to identify unauthorized attempts to reach the ISST subsystem.

Monitoring Recommendations

Forward kernel ring buffer events and auditd logs to a centralized analytics platform for pattern analysis across the fleet.
Alert on any non-root or non-management-tool process opening /dev/isst_interface.
Track kernel version drift across managed Linux hosts to prioritize systems still exposed to the unpatched driver.

How to Mitigate CVE-2026-89442

Immediate Actions Required

Apply the upstream stable kernel updates that include the fix commits 0d90ab5, 207b4dc, 82e707e, a89f07d, and c847ea4.
Restrict access to /dev/isst_interface to trusted administrative accounts using file permissions or udev rules.
Inventory Linux hosts running Intel Xeon platforms with ISST enabled and prioritize them for patching.

Patch Information

The fix is delivered through five upstream stable kernel commits that reject socket_id >= topology_max_packages() and NULL sst_inst entries. Distribution kernels should incorporate one of the following: Kernel Commit 0d90ab5, Kernel Commit 207b4dc, Kernel Commit 82e707e, Kernel Commit a89f07d, or Kernel Commit c847ea4. Track vendor security advisories for backport availability.

Workarounds

Blacklist the isst_if_mbox_msr, isst_if_mbox_pci, and isst_if_common kernel modules on hosts that do not require ISST management.
Tighten permissions on /dev/isst_interface so only privileged management daemons can issue ioctls.
Disable ISST features in BIOS on systems where dynamic power domain tuning is not needed.

bash

# Restrict access to the ISST ioctl interface
chmod 600 /dev/isst_interface
chown root:root /dev/isst_interface

# Prevent ISST kernel modules from loading on hosts that do not need them
cat <<'EOF' > /etc/modprobe.d/blacklist-isst.conf
blacklist isst_if_common
blacklist isst_if_mbox_msr
blacklist isst_if_mbox_pci
blacklist isst_tpmi
blacklist isst_tpmi_core
EOF

# Confirm no active users of the interface
lsof /dev/isst_interface