The Linux kernel's ISST (Intel Speed Select Technology) platform/x86 code had a vulnerability in the isst_if_clos_assoc() function where the socket_id parameter was validated with a '>' comparison against topology_max_packages(), allowing socket_id == topology_max_packages() to pass. This caused an out-of-bounds access on the isst_common.sst_inst[] array, which is allocated with topology_max_packages() entries indexed from 0 to topology_max_packages() - 1. Furthermore, the code dereferenced isst_common.sst_inst[socket_id] without checking for NULL, which could occur for valid socket IDs without a bound TPMI SST instance. These issues led to potential out-of-bounds and NULL pointer dereferences in map_partition_power_domain_id() and subsequent power_domain_info accesses. The vulnerability was fixed by rejecting socket_id values greater than or equal to topology_max_packages() and NULL sst_inst pointers, consistent with checks in get_instance().

The vulnerability could lead to out-of-bounds memory access and NULL pointer dereference in the Linux kernel's ISST component. This may cause kernel crashes or undefined behavior. No information about active exploitation or broader impact is provided.

A fix is available that properly validates the socket_id parameter by rejecting values greater than or equal to topology_max_packages() and checking for NULL pointers before dereferencing. Users should apply the official kernel update that includes this patch. No additional mitigation steps are indicated.