The Linux kernel ISST driver contains a flaw in the functions isst_if_get_base_freq_mask, where a user‑supplied level is used directly as an index into a per‑level table without bounds checking. This causes an out‑of‑bounds read from the perf_levels[] array and the base‑frequency level‑info array, potentially allowing a local user to read arbitrary kernel memory. The vulnerability is classified as CWE‑125 and could lead to information disclosure or a kernel panic.

The issue affects any Linux kernel that includes the ISST driver and has the SST‑PP feature enabled. Because the kernel source does not specify version ranges, all unpatched Linux installations that load the IS or other systems that expose the ISST control interface to user space also fall within the affected scope.

The CVSS score of 4.4 denotes medium severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, meaning no known active exploitation exists. The attack vector is inferred to be local; an attacker must have the ability to send malformed ioctl requests to the ISST device. Although no public exploit is documented, the out‑of‑bounds read could result in kernel memory disclosure or a crash, representing a moderate risk for unpatched systems.