{"id":"CVE-2026-89442","title":"platform/x86: ISST: Validate socket ID in clos_assoc ioctl","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Validate socket ID in clos_assoc ioctl\n\nisst_if_clos_assoc() validates the user-supplied socket_id with\n'socket_id > topology_max_packages()', but i…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-476"],"vendor":"Linux","product":"Linux","affected":["Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < c847ea4851ecfa3462cc711ded2c3c3dd8d08ab8","Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < 0d90ab5f80e19cddfeb0c9fab47a1f34aa932075","Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < 82e707eff9e3b7ef6d96ecc23ea8876d20c7d6ca","Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < 207b4dc6eb100141b122b2602504a1429a4b6558","Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < a89f07db0cb95c54dac4a8406c79a04e44a73c3c","Linux 6.4"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:46:51.770Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89442","references":[{"url":"https://git.kernel.org/stable/c/c847ea4851ecfa3462cc711ded2c3c3dd8d08ab8"},{"url":"https://git.kernel.org/stable/c/0d90ab5f80e19cddfeb0c9fab47a1f34aa932075"},{"url":"https://git.kernel.org/stable/c/82e707eff9e3b7ef6d96ecc23ea8876d20c7d6ca"},{"url":"https://git.kernel.org/stable/c/207b4dc6eb100141b122b2602504a1429a4b6558"},{"url":"https://git.kernel.org/stable/c/a89f07db0cb95c54dac4a8406c79a04e44a73c3c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89442.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89442"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532359"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89442"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89442"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89442.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00168,"epssPercentile":0.06065,"scores":{"cna":7.8,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.453Z","slug":"CVE-2026-89442","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Validate socket ID in clos_assoc ioctl\n\nisst_if_clos_assoc() validates the user-supplied socket_id with\n'socket_id > topology_max_packages()', but isst_common.sst_inst[] is\nallocated with topology_max_packages() entries, so the valid index range\nis [0, topology_max_packages()).  The '>' comparison lets\nsocket_id == topology_max_packages() pass and index one entry past the\narray.\n\nIn addition, isst_common.sst_inst[socket_id] is NULL for an in-range\npackage that has no bound TPMI SST instance, and the pointer is used\nwithout a NULL check.  Both the out-of-bounds entry and the NULL pointer\nare then dereferenced by map_partition_power_domain_id() and the\nfollowing power_domain_info access.\n\nReject socket_id >= topology_max_packages() and a NULL sst_inst, matching\nthe checks already performed by get_instance().\n\n## Affected\n\n- `Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < c847ea4851ecfa3462cc711ded2c3c3dd8d08ab8`\n- `Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < 0d90ab5f80e19cddfeb0c9fab47a1f34aa932075`\n- `Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < 82e707eff9e3b7ef6d96ecc23ea8876d20c7d6ca`\n- `Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < 207b4dc6eb100141b122b2602504a1429a4b6558`\n- `Linux >= 12a7d2cb811dd8a884dea088a2701fcb8d00136e < a89f07db0cb95c54dac4a8406c79a04e44a73c3c`\n- `Linux 6.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89442.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224763,"id":"CVE-2026-89442","ts":1792401529464,"field":"cvss","old":"5.5","new":"7.8"},{"seq":224762,"id":"CVE-2026-89442","ts":1792401529464,"field":"severity","old":"medium","new":"high"},{"seq":204109,"id":"CVE-2026-89442","ts":1789490231605,"field":"cvss","old":"7.8","new":"5.5"},{"seq":204108,"id":"CVE-2026-89442","ts":1789490231605,"field":"severity","old":"high","new":"medium"},{"seq":198059,"id":"CVE-2026-89442","ts":1789384321600,"field":"cvss","old":"4.1","new":"7.8"},{"seq":198058,"id":"CVE-2026-89442","ts":1789384321600,"field":"severity","old":"medium","new":"high"},{"seq":183548,"id":"CVE-2026-89442","ts":1789356675838,"field":"cvss","old":"7.8","new":"4.1"},{"seq":183547,"id":"CVE-2026-89442","ts":1789356675838,"field":"severity","old":"high","new":"medium"},{"seq":153224,"id":"CVE-2026-89442","ts":1789285349620,"field":"cvss","old":null,"new":"7.8"},{"seq":153223,"id":"CVE-2026-89442","ts":1789285349620,"field":"severity","old":"none","new":"high"},{"seq":147339,"id":"CVE-2026-89442","ts":1789270210519,"field":"cvss","old":null,"new":"4.1"},{"seq":147338,"id":"CVE-2026-89442","ts":1789270210519,"field":"severity","old":"none","new":"medium"},{"seq":109094,"id":"CVE-2026-89442","ts":1789183730282,"field":"cvss","old":null,"new":"4.1"},{"seq":109093,"id":"CVE-2026-89442","ts":1789183730282,"field":"severity","old":"none","new":"medium"}]}