CVE-2026-89470: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
In the Linux kernel, the following vulnerability has been resolved:
power: supply: crosusbpd: Limit port counts to ECUSBPDMAXPORTS
Currently the crosusbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and subsequent memory corruption.
Update helper functions in crosusbpd-charger to limit port counts to ECUSBPDMAXPORTS.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
An attacker would need a malicious or compromised embedded controller that reports an inaccurate charger port count. The vulnerable driver uses that raw count during probe, allowing a value up to 255 to lead to an out-of-bounds write and memory corruption.
Which systems are realistically exposed?
Exposure is limited to Linux kernel systems using the cros_usbpd-charger driver and an embedded controller that supplies the charger port-count data. Systems without this driver path or without a malicious embedded controller are not described as affected.
What can be done if the kernel fix cannot be applied immediately?
The provided information identifies the embedded controller's reported port count as the attack source. A practical interim measure is to prevent use of untrusted or compromised embedded-controller firmware; no driver configuration workaround is provided.