A flaw in the Linux kernel’s ISST driver for x86 platforms allows an out‑of‑bounds array reference and a NULL pointer dereference when the clos_assoc ioctl is called with an invalid socket_id. The driver validates the ID using a ‘>’ comparison that incorrectly permits socket_id equal to topology_max_packages(), causing it to reference one element past the end of the sst_inst array and use a NULL pointer for packages without an SST instance. The resulting kernel fault brings the whole system down.

All Linux kernels that ship the unpatched ISST driver code are affected. This includes any distribution that contains the driver from the kernel source before the commit that added the bounds and NULL checks. No specific distribution or kernel release is enumerated, so any kernel variant—whether upstream or distribution‑patched—that contains the old driver code is at risk.

The CVSS score of 4.1 indicates a low severity impact, and the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely local, requiring access to the clos_assoc ioctl, which is typically restricted to privileged users. Successful exploitation would trigger a kernel crash, causing a denial of service but not providing privilege escalation or data disclosure.