CVE-2026-89443High· 7.1▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
— → 4.4
none → medium
— → 7.1
none → high
7.1 → 4.4
high → medium
4.4 → 7.1
medium → high
7.1 → 5.5
high → medium
Last analysed / modified upstream
5.5 → 7.1
medium → high
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: ISST: Validate level in perf mask ioctls
isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use the user-provided level as an index into perf_levels[] via _read_pp_level_info() and _read_bf_level_info(), but neither helper validates it first.
The adjacent level-info helpers reject levels above max_level before reading the same per-level register block. Add the same bounds checks to the mask helpers, and reject disabled SST-PP levels in isst_if_get_perf_level_mask() to match isst_if_get_perf_level_info().
This prevents out-of-bounds reads from the per-level offset table on invalid ioctl input.
Linux >= ea009e4769fa3bd05d4c111c3b6865eb3a9be829 < beb22ebf76c0415f22d2d0c3f1ff0627e7ae4a68Linux >= ea009e4769fa3bd05d4c111c3b6865eb3a9be829 < 1a8bab5ceee1a42a78de12d3d69f67516a20588eLinux >= ea009e4769fa3bd05d4c111c3b6865eb3a9be829 < 1889a9156553f0692acd57caf15e877baace1a01Linux >= ea009e4769fa3bd05d4c111c3b6865eb3a9be829 < d19385624bdfb577db9c94bb8879992fd5e17bcdLinux >= ea009e4769fa3bd05d4c111c3b6865eb3a9be829 < 80e0d353c86a9a168ad6d213f494796294381538Linux 6.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100070Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shor…
CVE-2026-100071Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before t…
CVE-2025-39977High· 7.8In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() fute…
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance