Skip to content
Heist/ feed
High

power: supply: cros_usbpd-charger: bound the EC-reported port count

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd-charger: bound the EC-reported port count cros_usbpd_charger_probe() reads two port counts from the EC and uses one of them, num_charger_ports, as the loop bound when populating a fixed-size array: struct port_data *ports[EC_USB_PD_MAX_PORTS]; /* 8 entries */ ... for (i = 0; i < charger->num_charger_ports; i++) charger->ports[charger->num_registered_psy++] = port; Both num_usbpd_ports (from EC_CMD_USB_PD_PORTS) and num_charger_ports (from EC_CMD_CHARGE_PORT_COUNT) are u8 values reported by the EC. The only validation is a sanity check that compares the two EC-reported values against each other: if (num_charger_ports < num_usbpd_ports || num_charger_ports > num_usbpd_ports + 1) return -EPROTO; It never checks either count against EC_USB_PD_MAX_PORTS, the size of the ports[] array. A malfunctioning, malicious or compromised EC that reports num_usbpd_ports == num_charger_ports == N for any N > 8 (for example both 255) passes this check, and the loop then writes N pointers into the 8-entry ports[] array embedded in the devm_kzalloc()'d charger_data, overflowing it by up to 255 - 8 = 247 entries (~1976 bytes): a slab out-of-bounds write. Reject a port count larger than the ports[] array can hold.

Announced Source revision 1
Original source ↗

CVE-2026-89471

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-89471

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "f68b883e8fad23ed0ac4756d91594809d78678ed",
        "lessThan": "0b5096f6804161b61451b1cec0e38678630be849",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f68b883e8fad23ed0ac4756d91594809d78678ed",
        "lessThan": "c46c9f447415ca802afab51dea1eafc08ddff1c6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f68b883e8fad23ed0ac4756d91594809d78678ed",
        "lessThan": "a1905375dfc0b9612bbee52fc066e3a70c0d671d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f68b883e8fad23ed0ac4756d91594809d78678ed",
        "lessThan": "2746d502b12b343384fb747bdef9cbcfbd7444a2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f68b883e8fad23ed0ac4756d91594809d78678ed",
        "lessThan": "fd29d08ee487f3bf50f2575aaa74f78a74b09b21",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f68b883e8fad23ed0ac4756d91594809d78678ed",
        "lessThan": "78be8b7403ff7638162438b664a07d19da76059e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f68b883e8fad23ed0ac4756d91594809d78678ed",
        "lessThan": "3d1e01443b221081258ff34ea0cdd0431e4ff62e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "f68b883e8fad23ed0ac4756d91594809d78678ed",
        "lessThan": "48355ce49359740f52e94d3623f6fc557ce341f0",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/power/supply/cros_usbpd-charger.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.19"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.19",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.270",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.221",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.188",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.109",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.50",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.4",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/power/supply/cros_usbpd-charger.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-89471

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#35001 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement