HIGH Introduced in 5.7
cros_ec SensorNum OOB
CVE-2026-81017
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number (in->sensor_num). cros_ec_sensorhub_ring_handler() validates the FIFO event count, the per-read count and the ring bound, but not the sensor number, which cros_ec_sensor_ring_process_event() then uses unchecked to index sensorhub->batch_state[] - allocated with only sensorhub->sensor_num entries. A sensor number of sensor_num or larger is an out-of-bounds read and write of batch_state[]. Validate the sensor number in the ring handler, where each event is read from the EC, and drop a malformed event before it is used.
02KernelScan AI Analysis
Risk summary
A missing bounds check on a sensor number reported by the Chrome OS Embedded Controller allows out-of-bounds access to a heap-allocated array, leading to memory corruption or a kernel crash. The vulnerability is limited to devices with a Chrome OS EC and the sensorhub driver loaded. Triggering requires the EC to produce a malformed sensor number, which typically requires a compromised EC or physical access to the EC communication bus.
Vulnerability analysis
The Chrome OS Embedded Controller sensorhub driver processes sensor events from the EC, each carrying a sensor number that is used to index an internal array. The driver checked the number of events and buffer limits but not the sensor number itself, so a value from the EC larger than the allocated array causes out-of-bounds reads and writes on the heap. The fix adds a bounds check when events are read from the EC, dropping any malformed event before it is processed. The bug only affects Chrome OS devices with an EC and active sensors. An attacker would need to cause the EC to report an invalid sensor number, which typically requires either compromised EC firmware or physical access to the EC communication bus on the board.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.7 | 5.10.270 | 3a76b87e1d06 |
| 5.15 | 5.7 | 5.15.221 | 2b602ecf6193 |
| 6.1 | 5.7 | 6.1.188 | 324880f94ba3 |
| 6.12 | 5.7 | 6.12.109 | 3d2636dce0a8 |
| 6.18 | 5.7 | 6.18.50 | 5eaf7faa9957 |
| 6.6 | 5.7 | 6.6.157 | d1b4add68dab |
| 7.2 | 5.7 | 7.2.4 | 4d9bf63ed74f |
| mainline | 5.7 | 7.3 | 833740a2333c |
| cip/5.10 | 5.7 | 5.10.271-cip78 | 3a76b87e1d06 |
| cip/6.1 | 5.7 | 6.1.189-cip61 | 324880f94ba3 |
| cip/6.1-rt | 5.7 | 6.1.189-cip61-rt32 | 324880f94ba3 |
| cip/6.12 | 5.7 | 6.12.111-cip32 | 3d2636dce0a8 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |