CVE-2026-89471

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: cros_usbpd-charger: bound the EC-reported port count

cros_usbpd_charger_probe() reads two port counts from the EC and uses

one of them, num_charger_ports, as the loop bound when populating a

fixed-size array:

struct port_data *ports[EC_USB_PD_MAX_PORTS]; /* 8 entries */

...

for (i = 0; i < charger->num_charger_ports; i++)

charger->ports[charger->num_registered_psy++] = port;

Both num_usbpd_ports (from EC_CMD_USB_PD_PORTS) and num_charger_ports

(from EC_CMD_CHARGE_PORT_COUNT) are u8 values reported by the EC. The

only validation is a sanity check that compares the two EC-reported

values against each other:

if (num_charger_ports < num_usbpd_ports ||

num_charger_ports > num_usbpd_ports + 1)

return -EPROTO;

It never checks either count against EC_USB_PD_MAX_PORTS, the size of

the ports[] array. A malfunctioning, malicious or compromised EC that

reports num_usbpd_ports == num_charger_ports

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References