CVE-2026-89442

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: ISST: Validate socket ID in clos assoc ioctl

isst if clos assoc() validates the user-supplied socket id with 'socket id > topology max packages()', but isst common.sst inst[] is allocated with topology max packages() entries, so the valid index range is [0, topology max packages()). The '>' comparison lets socket id == topology max packages() pass and index one entry past the array.

In addition, isst common.sst inst[socket id] is NULL for an in-range package that has no bound TPMI SST instance, and the pointer is used without a NULL check. Both the out-of-bounds entry and the NULL pointer are then dereferenced by map partition power domain id() and the following power domain info access.

Reject socket id >= topology max packages() and a NULL sst inst, matching the checks already performed by get instance().