The kernel incorrectly resets the SST-PP control offset only for power domain zero after a resume operation. During suspend, the control values for all power domains are read and stored, but the restoration process uses the pointer to power_domain_info->sst_base, which points only to the base address of power domain zero. The result is that power domain management may operate with stale or incorrect control registers, potentially destabilizing the system or causing a denial of service by improperly shutting down or powering devices. This weakness is manifested as a kernel memory handling error that compromises the integrity of power domain configuration.

All Linux kernel builds are affected, because the vulnerability originates in the generic x86 ISST power management code referenced by the kernel’s vendor product image.

The EPSS score is <1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.1 indicates high severity. The defect requires privileged kernel execution because it occurs within core power management components; it is therefore considered a local, privilege-dependent flaw. An attacker with local or kernel privileges could trigger the suspend/resume cycle to provoke corruption, potentially leading to service disruption. The lack of publicly known exploits suggests that the risk to unprivileged users is low, but any system that relies on reliable power domain control is recommended to update promptly.