CVE-2026-89443: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89443 Overview

CVE-2026-89443 is an out-of-bounds read vulnerability in the Linux kernel's Intel Speed Select Technology (ISST) platform driver. The isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() functions accept a user-provided level value through ioctl interfaces. These functions use the level as an index into the perf_levels[] array through _read_pp_level_info() and _read_bf_level_info() helpers without validating the input first. A local user with access to the ISST device can trigger reads beyond the valid per-level offset table.

Critical Impact
Local users can trigger out-of-bounds reads from the per-level offset table, potentially disclosing adjacent kernel memory or causing kernel instability through crafted ioctl calls.

Affected Products

Linux kernel platform/x86 ISST driver (Intel Speed Select Technology)
Multiple stable branches referenced in the fix commits
Systems exposing the ISST character device to unprivileged or semi-privileged users

Discovery Timeline

2026-09-11 - CVE-2026-89443 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89443

Vulnerability Analysis

The vulnerability resides in the Intel Speed Select Technology (ISST) driver under platform/x86. Two ioctl handlers, isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask(), accept a level value supplied by userspace. Both handlers forward that value to _read_pp_level_info() and _read_bf_level_info() respectively, which use it as an index into perf_levels[] to locate the per-level register block.

Adjacent level-info helpers in the same driver reject levels exceeding max_level before reading the register block. The mask helpers did not perform equivalent bounds checking. A userspace caller can therefore pass a level index outside the valid range and trigger an out-of-bounds read into the per-level offset table.

The fix adds the missing bounds checks to both mask helpers and also rejects disabled SST-PP levels in isst_if_get_perf_level_mask(), aligning its validation with isst_if_get_perf_level_info().

Root Cause

The root cause is missing input validation on an array index supplied through a kernel ioctl. The level parameter was trusted without verification against max_level, allowing arbitrary index values to reach the per-level offset table lookup.

Attack Vector

Exploitation requires local access and the ability to open the ISST character device and invoke the affected ioctls. A local user issues an ioctl with an out-of-range level value, causing the kernel to read memory beyond the intended perf_levels[] bounds. The result is potential kernel information disclosure or a kernel crash impacting system availability.

No synthetic proof-of-concept is provided. Refer to the upstream fix commits for the corrected validation logic.

Detection Methods for CVE-2026-89443

Indicators of Compromise

Unexpected kernel oops or panic messages referencing isst_if_get_perf_level_mask or isst_if_get_base_freq_mask in dmesg or /var/log/kern.log.
KASAN or slab out-of-bounds warnings originating from the platform/x86 ISST driver during ioctl handling.
Unusual ioctl activity against ISST device nodes from non-administrative processes.

Detection Strategies

Monitor kernel ring buffer output for stack traces implicating ISST perf-level or base-frequency mask helpers.
Correlate process execution telemetry with access to ISST device files to identify uncommon callers.
Enable kernel hardening options such as KASAN in test environments to surface out-of-bounds reads during validation.

Monitoring Recommendations

Track kernel version inventory across Linux hosts to identify systems running unpatched builds of the ISST driver.
Alert on kernel crashes or repeated ioctl failures targeting ISST device nodes.
Review audit logs for processes opening /dev/isst_interface outside of authorized management tooling.

How to Mitigate CVE-2026-89443

Immediate Actions Required

Apply the upstream kernel patches that add bounds checks to isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask().
Update to a distribution kernel that includes the referenced stable commits.
Restrict access to ISST device nodes to trusted administrative users only.

Patch Information

Upstream fixes are available in the following commits: Kernel Commit 1889a91, Kernel Commit 1a8bab5, Kernel Commit 80e0d35, Kernel Commit beb22eb, and Kernel Commit d193856. The patches validate the level argument against max_level and reject disabled SST-PP levels before indexing perf_levels[].

Workarounds

Unload the ISST driver on systems that do not require Intel Speed Select functionality using modprobe -r isst_if_mbox_msr isst_if_mbox_pci isst_if_common.
Tighten permissions on the ISST device node so only privileged administrative accounts can invoke the affected ioctls.
Blocklist the ISST kernel modules in /etc/modprobe.d/ on hosts where the feature is not needed.

bash

# Configuration example: disable ISST modules until the kernel is patched
echo 'blacklist isst_if_common' | sudo tee /etc/modprobe.d/disable-isst.conf
echo 'blacklist isst_if_mbox_msr' | sudo tee -a /etc/modprobe.d/disable-isst.conf
echo 'blacklist isst_if_mbox_pci' | sudo tee -a /etc/modprobe.d/disable-isst.conf
sudo modprobe -r isst_if_mbox_msr isst_if_mbox_pci isst_if_common 2>/dev/null || true
sudo chmod 600 /dev/isst_interface 2>/dev/null || true