CVE-2026-89470

power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

State: Published
Severity: 8.4 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Currently the cros_usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and subsequent memory corruption.

Update helper functions in cros_usbpd-charger to limit port counts to EC_USB_PD_MAX_PORTS.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3af15cfacd1eef7f223802d49a88cae23c509183 to before e951b65ef1699439079b723ca5c72cbe44771647Affected 3af15cfacd1eef7f223802d49a88cae23c509183 to before 3ce9218639ff62d011eb8aca0943aa670a654c7bAffected 3af15cfacd1eef7f223802d49a88cae23c509183 to before dce1750ddbd3380b1f6090dda2b07d2ebea2261dAffected 3af15cfacd1eef7f223802d49a88cae23c509183 to before 3262977a05b23d1be9fc86727a2b490ec997543eAffected 3af15cfacd1eef7f223802d49a88cae23c509183 to before fd5f289cca04ad869b34fc9ccb647670bfdb60acAffected 3af15cfacd1eef7f223802d49a88cae23c509183 to before 4b1f2be1e1b74a50386ba718de3d62bfcf5ee701Affected 3af15cfacd1eef7f223802d49a88cae23c509183 to before 304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60Affected 3af15cfacd1eef7f223802d49a88cae23c509183 to before 657cd3a42e937276262c0a8ae6b01a87004309deAffected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

3af15cfacd1eef7f223802d49a88cae23c509183 to before e951b65ef1699439079b723ca5c72cbe44771647Affected
3af15cfacd1eef7f223802d49a88cae23c509183 to before 3ce9218639ff62d011eb8aca0943aa670a654c7bAffected
3af15cfacd1eef7f223802d49a88cae23c509183 to before dce1750ddbd3380b1f6090dda2b07d2ebea2261dAffected
3af15cfacd1eef7f223802d49a88cae23c509183 to before 3262977a05b23d1be9fc86727a2b490ec997543eAffected
3af15cfacd1eef7f223802d49a88cae23c509183 to before fd5f289cca04ad869b34fc9ccb647670bfdb60acAffected
3af15cfacd1eef7f223802d49a88cae23c509183 to before 4b1f2be1e1b74a50386ba718de3d62bfcf5ee701Affected
3af15cfacd1eef7f223802d49a88cae23c509183 to before 304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60Affected
3af15cfacd1eef7f223802d49a88cae23c509183 to before 657cd3a42e937276262c0a8ae6b01a87004309deAffected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.