HIGH Introduced in 4.20
cros_usbpd PortCount OOB
CVE-2026-89470
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Currently the cros_usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and subsequent memory corruption. Update helper functions in cros_usbpd-charger to limit port counts to EC_USB_PD_MAX_PORTS.
02KernelScan AI Analysis
Risk summary
The cros_usbpd-charger driver trusts a port count returned by the ChromeOS embedded controller without bounding it to the maximum supported array size. A malicious EC can return an inflated count, causing out-of-bounds writes and kernel memory corruption during driver probe. This is only reachable on ChromeOS-style hardware with a cros EC, and requires a compromised EC via physical access or supply-chain tampering.
Vulnerability analysis
The cros_usbpd-charger driver trusts port counts returned by the ChromeOS embedded controller during device probe, using them to iterate over internal arrays without first validating against the maximum supported size. A malicious or compromised embedded controller could return an inflated port count, causing the driver to write past the end of its arrays and corrupt kernel memory. The fix limits the port count to the hardware maximum before using it, preventing out-of-bounds access. This vulnerability is reachable only on ChromeOS-style hardware with a cros embedded controller, and triggering it requires a malicious EC — either through physical access to flash compromised firmware or a supply-chain compromise of the EC itself.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.20 | 5.10.270 | e951b65ef169 |
| 5.15 | 4.20 | 5.15.221 | 3ce9218639ff |
| 6.1 | 4.20 | 6.1.188 | dce1750ddbd3 |
| 6.12 | 4.20 | 6.12.109 | fd5f289cca04 |
| 6.18 | 4.20 | 6.18.50 | 4b1f2be1e1b7 |
| 6.6 | 4.20 | 6.6.157 | 3262977a05b2 |
| 7.2 | 4.20 | 7.2.4 | 304a29ac55ba |
| mainline | 4.20 | 7.3 | 657cd3a42e93 |
| cip/5.10 | 4.20 | 5.10.271-cip78 | e951b65ef169 |
| cip/6.1 | 4.20 | 6.1.189-cip61 | dce1750ddbd3 |
| cip/6.1-rt | 4.20 | 6.1.189-cip61-rt32 | dce1750ddbd3 |
| cip/6.12 | 4.20 | 6.12.111-cip32 | fd5f289cca04 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |