Linux kernel Intel Speed Select: unvalidated ioctl indices reach MMIO offsets and NULL instances

Impact

The Intel Speed Select Technology driver on Xeon hosts takes CPU ids, CLOS ids, socket ids and SST-PP level numbers straight from userspace ioctls and uses them to compute MMIO offsets or to index isst_common.sst_inst[]. Unvalidated values give out-of-bounds reads of the per-level offset table, an index one entry past the socket array, and dereference of a NULL instance pointer for a package with no bound TPMI instance - crashing the host or reading adjacent kernel memory. The practical exposure is a local user or container that holds the ISST character device; on a normal GPU node that device is root-owned, so this is a hardening fix rather than a tenant-reachable escape. A crash still costs a reboot of a node that cannot be drained cheaply. The kernel CNA split this across four ids (CVE-2026-89438, -89439, -89442, -89443); they are the same class of missing bounds and NULL checks in one driver with one remediation.

Who can reach it

Local user or privileged container able to open the ISST interface device on an Intel Xeon host. No remote path; no unauthenticated path.

What to do

Update to a stable kernel carrying all four fixes and reboot the affected hosts - drain the node first, since a GPU host cannot take a kernel reboot in place. No mitigation short of restricting access to the ISST device is described in the records. The records do not name specific fixed release numbers beyond the linked stable commits.

Also covers 3 CVEs

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• Linux kernel iommufd: current IOAS rwsem and reference leaked when the unwind path misses itCVE-2026-89446 · Linux kernel iommufd (IOAS rwsem and object reference left held on xa_store failure)Unscored
• Linux kernel iommufd: reference leak on unmap when an internal access is skippedCVE-2026-89447 · Linux kernel iommufd (object reference leak when skipping internal accesses on unmap)Unscored
• Linux kernel VT-d: ACS not requested under tboot, leaving peer-to-peer DMA isolation offCVE-2026-89448 · Linux kernel iommu/vt-d (ACS request when tboot forces the IOMMU on)Unscored
• Linux kernel Tegra241 CMDQV: oversized guest vSID truncates and aliases the wrong Stream IDCVE-2026-89450 · Linux kernel iommu/tegra241-cmdqv (guest vSID programmed into SID_MATCH)Unscored
• Linux kernel iommu/sva: racing bind can return an SVA handle with a NULL dev pointerCVE-2026-89451 · Linux kernel iommu/sva (shared virtual addressing handle initialization)Unscored
• Linux kernel iommu/amd: every handled PPR fault leaks a PCI device referenceCVE-2026-89453 · Linux kernel iommu/amd (PPR/IOPF notifier PCI device reference)Unscored