CVE-2026-81017: platform/chrome: sensorhub: Bound the EC-reported sensor number
In the Linux kernel, the following vulnerability has been resolved:
platform/chrome: sensorhub: Bound the EC-reported sensor number
Each EC FIFO event carries an 8-bit sensor number (in->sensornum). crosecsensorhubringhandler() validates the FIFO event count, the per-read count and the ring bound, but not the sensor number, which crosecsensorringprocessevent() then uses unchecked to index sensorhub->batchstate[] - allocated with only sensorhub->sensornum entries. A sensor number of sensornum or larger is an out-of-bounds read and write of batchstate[].
Validate the sensor number in the ring handler, where each event is read from the EC, and drop a malformed event before it is used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Compensating control
In cros_ec_sensorhub_ring_handler(), validate each EC FIFO event's sensor number before cros_ec_sensor_ring_process_event() uses it, and drop the event when in->sensor_num is greater than or equal to sensorhub->sensor_num.
Event History
Frequently Asked Questions
What condition is required to trigger the memory-safety issue?
The embedded controller must provide a FIFO event whose 8-bit sensor number is greater than or equal to the number of sensors allocated by the sensor hub. That value is then used to index the batch_state array outside its bounds.
Which systems are exposed?
Exposure is limited to systems using the Chrome platform sensorhub path that accepts FIFO events from an embedded controller. The provided data does not identify affected kernel versions or default configurations.
What does the fix do?
The fix validates each EC-reported sensor number in the ring handler and drops malformed events before they reach the code that indexes batch_state.