A critical out of bounds memory access vulnerability in the Linux kernel ISST driver could allow a local attacker with low privileges to achieve code execution or cause a system crash.

The vulnerability exists in the isst_if_clos_assoc function, which performs improper validation of a user supplied socket ID. An attacker can provide an out of bounds index to trigger a memory corruption, or dereference a NULL pointer, during subsequent power domain operations.

Successful exploitation allows a local authenticated user to compromise system integrity and availability. Given the CVSS score of 7.8, this flaw presents a high risk as it provides a pathway for privilege escalation, which could result in full system compromise or persistent denial of service conditions.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults that occur during ioctl operations related to Intel Speed Select Technology (ISST).

Compensating Controls: Restrict access to system ioctls and limit the ability of low privileged users to interact with hardware interfaces if the kernel cannot be patched immediately.

Public Exploit Available: No

The vulnerability represents a significant security risk to Linux systems utilizing the ISST subsystem. Administrators should prioritize patching the kernel to the versions specified above to eliminate the risk of out of bounds memory access and potential privilege escalation.