CVE-2026-89471: power: supply: cros_usbpd-charger: bound the EC-reported port count
In the Linux kernel, the following vulnerability has been resolved:
power: supply: crosusbpd-charger: bound the EC-reported port count
crosusbpdchargerprobe() reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array:
struct portdata ports[ECUSBPDMAXPORTS]; / 8 entries / ... for (i = 0; i < charger->numchargerports; i++) charger->ports[charger->numregisteredpsy++] = port;
Both numusbpdports (from ECCMDUSBPDPORTS) and numchargerports (from ECCMDCHARGEPORTCOUNT) are u8 values reported by the EC. The only validation is a sanity check that compares the two EC-reported values against each other:
if (numchargerports < numusbpdports || numchargerports > numusbpdports + 1) return -EPROTO;
It never checks either count against ECUSBPDMAXPORTS, the size of the ports[] array. A malfunctioning, malicious or compromised EC that reports numusbpdports == numchargerports == N for any N > 8 (for example both 255) passes this check, and the loop then writes N pointers into the 8-entry ports[] array embedded in the devmkzalloc()'d chargerdata, overflowing it by up to 255 - 8 = 247 entries (~1976 bytes): a slab out-of-bounds write.
Reject a port count larger than the ports[] array can hold.
Affected Software
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems using the Linux kernel cros_usbpd-charger driver are exposed when their embedded controller reports USB Power Delivery and charger port counts greater than the driver's fixed eight-entry port array.
What must an attacker or fault condition control to trigger the overflow?
The embedded controller must report matching num_usbpd_ports and num_charger_ports values above 8. For example, reporting both values as 255 passes the driver's consistency check and causes writes past the ports[] array.
Is the existing consistency check between the two EC-reported counts sufficient?
No. It only verifies that num_charger_ports is at least num_usbpd_ports and no more than one greater; it does not bound either value to EC_USB_PD_MAX_PORTS, which is 8.
How large can the overwrite be based on the reported values?
With counts reported as 255, the loop can write 255 pointers into an eight-entry array. This can overflow the array by up to 247 entries.