{"id":"CVE-2026-89443","summary":"platform/x86: ISST: Validate level in perf mask ioctls","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Validate level in perf mask ioctls\n\nisst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the\nuser-provided level as an index into perf_levels[] via\n_read_pp_level_info() and _read_bf_level_info(), but neither helper\nvalidates it first.\n\nThe adjacent level-info helpers reject levels above max_level before\nreading the same per-level register block. Add the same bounds checks to\nthe mask helpers, and reject disabled SST-PP levels in\nisst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().\n\nThis prevents out-of-bounds reads from the per-level offset table on\ninvalid ioctl input.","modified":"2026-09-13T03:47:18.036658157Z","published":"2026-09-11T19:43:11.407Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89443.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1889a9156553f0692acd57caf15e877baace1a01"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1a8bab5ceee1a42a78de12d3d69f67516a20588e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/80e0d353c86a9a168ad6d213f494796294381538"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d19385624bdfb577db9c94bb8879992fd5e17bcd"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89443.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89443"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ea009e4769fa3bd05d4c111c3b6865eb3a9be829"},{"fixed":"1a8bab5ceee1a42a78de12d3d69f67516a20588e"},{"fixed":"1889a9156553f0692acd57caf15e877baace1a01"},{"fixed":"d19385624bdfb577db9c94bb8879992fd5e17bcd"},{"fixed":"80e0d353c86a9a168ad6d213f494796294381538"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89443.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89443.json"}}],"schema_version":"1.9.0"}