The Linux kernel’s ISST driver for x86 does not validate logical CPU identifiers and CLOS ( Cache Level of Service) IDs when configuring core power features. Because these values are used to calculate an MMIO (memory‑mapped I/O) offset, unvalidated or excessively large values may produce an incorrect address. If the driver subsequently accesses memory at that calculated offset, it could read or write outside the intended region. While the CVE description does not explicitly state the consequence, it can be inferred that such unchecked access may corrupt kernel data structures or trigger a system crash.

Any Linux kernel build that includes the ISST driver on x86 architectures is affected. The patch that introduced validation applies to all prior kernel versions; specific version ranges are not listed, so any kernel lacking the update should be considered vulnerable.

The CVSS score of 4.7 indicates moderate potential impact, and the EPSS score of less than 1% signals a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker would need to invoke core power features through the ISST driver interface, a capability typically limited to privileged users. Because the exploit path requires local code that can supply the invalid identifiers, remote exploitation is unlikely, and there is no known public exploit.