EUVD-2026-76348
GHSA-66vv-5f3v-p2fx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local ioctl access with low privilege suffices to trigger boundary violation; full kernel memory impact justifies C:H/I:H/A:H with no scope change.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: ISST: Validate socket ID in clos_assoc ioctl
isst_if_clos_assoc() validates the user-supplied socket_id with 'socket_id > topology_max_packages()', but isst_common.sst_inst[] is allocated with topology_max_packages() entries, so the valid index range is [0, topology_max_packages()). The '>' comparison lets socket_id == topology_max_packages() pass and index one entry past the array.
In addition, isst_common.sst_inst[socket_id] is NULL for an in-range package that has no bound TPMI SST instance, and the pointer is used without a NULL check. Both the out-of-bounds entry and the NULL pointer are then dereferenced by map_partition_power_domain_id() and the following power_domain_info access.
Reject socket_id >= topology_max_packages() and a NULL sst_inst, matching the checks already performed by get_instance().
AnalysisAI
Two compounding flaws in the Linux kernel's Intel Speed Select Technology (ISST) ioctl handler allow a local low-privileged user to trigger out-of-bounds memory access or NULL pointer dereference in kernel space. The isst_if_clos_assoc() function applies an off-by-one validator (> instead of >=) against the sst_inst[] array boundary, permitting socket_id equal to topology_max_packages() to index one entry past the allocated array; a second path omits a NULL check for valid in-range socket IDs whose package has no bound TPMI SST instance, both dereferences reaching map_partition_power_domain_id(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user session with sufficient permissions to open and issue ioctls to the ISST character device (e.g., `/dev/isst_interface`); on most distributions this requires root or `CAP_SYS_ADMIN`, though explicit device-node ACLs granting non-root access are the condition under which PR:L applies. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) accurately characterizes local exploitation via a crafted ioctl call requiring only low privileges and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched Linux kernel: 6.12.109, 6.18.50, 7.2.4, or any later release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify systems running vulnerable Linux kernel versions (check with 'uname -r' and confirm version is below 6.12.109, 6.18.50, or 7.2.4) and restrict non-administrative local user access where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today