HIGH Introduced in 5.7
platform/chrome RingHandler OOB
CVE-2026-93165
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
KernelScan AI6.0MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler `max_response` and `sensor_num` are read from different EC commands: - `max_response` is from cros_ec_get_proto_info(). ec_dev->max_response = info->max_response_packet_size - sizeof(struct ec_host_response); - `sensor_num` is from cros_ec_get_sensor_count(). sensor_num = cros_ec_get_sensor_count(ec); With a malfunctioning EC firmware, it is possible that the `msg->insize` (i.e., `fifo_info_length` in the context) could be clamped in cros_ec_cmd_xfer() because `msg->insize` is greater than `max_response`. int fifo_info_length = sizeof(struct ec_response_motion_sense_fifo_info) + sizeof(u16) * sensorhub->sensor_num; This means the number of read bytes could be less than expected. As a result, the subsequent memcpy() in cros_ec_sensorhub_ring_handler() overreads the `resp->fifo_info` buffer. Check the return value of cros_ec_cmd_xfer_status() and abort if the number of bytes read does not match the expected length.
02KernelScan AI Analysis
Risk summary
A memory overread in the Chrome OS EC sensorhub ring handler affects devices with cros_ec sensorhub hardware. When the EC firmware reports inconsistent sensor count and maximum response size values, the kernel copies more bytes from a response buffer than were actually written, potentially leaking kernel memory or causing a panic. The bug is triggered by the EC itself during normal sensor event processing, but causing the EC to return the inconsistent data requires either a firmware bug or prior compromise of the EC firmware, which typically requires root access on the host or physical device access.
Vulnerability analysis
The Chrome OS EC sensorhub driver copies sensor data from responses sent by the Embedded Controller. If the EC supplies inconsistent size values, the kernel may read past the end of the received data and copy excess bytes, exposing adjacent kernel memory or crashing the system. The fix checks that the amount of data received matches the expected length before copying, and stops processing if they differ. Only devices with Chrome OS EC sensorhub hardware are affected. Triggering the flaw requires the EC to return malformed size values, which generally means the EC firmware is either malfunctioning or has been compromised through root access on the host or physical device access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.7 | 5.10.270 | 98604cc8fd25 |
| 5.15 | 5.7 | 5.15.221 | 86bcfab7dff6 |
| 6.1 | 5.7 | 6.1.188 | 7e901aaf9582 |
| 6.12 | 5.7 | 6.12.110 | ee0403520cdb |
| 6.18 | 5.7 | 6.18.52 | 847a5ba0ac75 |
| 6.6 | 5.7 | 6.6.157 | 7780d93ae28f |
| 7.2 | 5.7 | 7.2.6 | 6268f46d8387 |
| mainline | 5.7 | 7.3 | d1ceb2b23247 |
| cip/5.10 | 5.7 | 5.10.271-cip78 | 98604cc8fd25 |
| cip/6.1 | 5.7 | 6.1.189-cip61 | 7e901aaf9582 |
| cip/6.1-rt | 5.7 | 6.1.189-cip61-rt32 | 7e901aaf9582 |
| cip/6.12 | 5.7 | 6.12.111-cip32 | ee0403520cdb |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |