CVE-2026-89439

platform/x86: ISST: Add a NULL check for sst_inst[]

Published Sep 11, 2026 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: ISST: Add a NULL check for sst_inst[]

To be consistent with other places, add a NULL check for failed socket
loading by checking isst_common.sst_inst[].

Analysis

Technical impact

The Linux kernel ISST driver contains a null pointer dereference. When a socket load fails, the driver accesses the sst_inst[] array without checking for a null value, which can cause the kernel to crash. This crash results in a loss of system availability and may require a reboot to recover.

Affected Systems

The vulnerability applies to any Linux kernel build that does not contain the recent patch adding the NULL check for sst_inst[]. All system configurations running such kernel versions are at risk, regardless of architecture, as the defect lies in the platform/x86 ISST driver.

Risk and Exploitability

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% and absence from CISA’s KEV catalog suggest a not specify an attack vector, but the failure mode involves a kernel crash triggered the description, it is inferred that exploitation would require local activity that triggers the problematic socket load and likely privileged or elevated permissions to observe the impact.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d805456c712f93ba8a012430f2a93bec133b6ff4`	affected	< f7c9370dd1d3cedb80c635528271cab1d0bcb103
`d805456c712f93ba8a012430f2a93bec133b6ff4`	affected	< 49a95fe1f64f41c2e8959e525aefdb10f23b293e
`d805456c712f93ba8a012430f2a93bec133b6ff4`	affected	< c280fcd53b938b70c7dee9ce1a66b32bd6e5ebaa
`d805456c712f93ba8a012430f2a93bec133b6ff4`	affected	< ef7975af15126dd70ace519da7bb33f2848b9064
`d805456c712f93ba8a012430f2a93bec133b6ff4`	affected	< 3de2776e9d7073765c10c2326c2bda5926811ea6

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`6.6.160`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[d805456c712f93ba8a012430f2a93bec133b6ff4,49a95fe1f64f41c2e8959e525aefdb10f23b293e)`	affected	code_commit	—
`[d805456c712f93ba8a012430f2a93bec133b6ff4,c280fcd53b938b70c7dee9ce1a66b32bd6e5ebaa)`	affected	code_commit	—
`[d805456c712f93ba8a012430f2a93bec133b6ff4,ef7975af15126dd70ace519da7bb33f2848b9064)`	affected	code_commit	—
`[d805456c712f93ba8a012430f2a93bec133b6ff4,3de2776e9d7073765c10c2326c2bda5926811ea6)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.4`	affected	semver	—
`[0,6.4)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the latest Linux kernel version that includes the commit adding the NULL check for sst_inst[].
Reboot the system so that the updated driver is loaded into memory.
Enable automatic kernel security updates or maintain a schedule to manually apply kernel patches promptly.

Generated by OpenCVE AI on September 21, 2026 at 01:32 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3de2776e9d7073765c10c2326c2bda5926811ea6
https://git.kernel.org/stable/c/49a95fe1f64f41c2e8959e525aefdb10f23b293e
https://git.kernel.org/stable/c/c280fcd53b938b70c7dee9ce1a66b32bd6e5ebaa
https://git.kernel.org/stable/c/ef7975af15126dd70ace519da7bb33f2848b9064
https://git.kernel.org/stable/c/f7c9370dd1d3cedb80c635528271cab1d0bcb103
https://nvd.nist.gov/vuln/detail/CVE-2026-89439
https://www.cve.org/CVERecord?id=CVE-2026-89439

History

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/f7c9370dd1d3cedb80c635528271cab1d0bcb103

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89439 https://www.cve.org/CVERecord?id=CVE-2026-89439
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sst_inst[] To be consistent with other places, add a NULL check for failed socket loading by checking isst_common.sst_inst[].
Title		platform/x86: ISST: Add a NULL check for sst_inst[]
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3de2776e9d7073765c10c2326c2bda5926811ea6 https://git.kernel.org/stable/c/49a95fe1f64f41c2e8959e525aefdb10f23b293e https://git.kernel.org/stable/c/c280fcd53b938b70c7dee9ce1a66b32bd6e5ebaa https://git.kernel.org/stable/c/ef7975af15126dd70ace519da7bb33f2848b9064