Out-of-bounds write in Linux kernel - CVE-2026-89470

Vulnerability details

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in the cros_usbpd-charger driver probe when processing a raw charger port count returned by the embedded controller. An attacker with physical access can cause the embedded controller to report an inaccurate port count to cause memory corruption.

The embedded controller can report a port count of up to 255.

Affected software

How to mitigate CVE-2026-89470

External References

• https://git.kernel.org/stable/c/304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60
• https://git.kernel.org/stable/c/4b1f2be1e1b74a50386ba718de3d62bfcf5ee701
• https://git.kernel.org/stable/c/657cd3a42e937276262c0a8ae6b01a87004309de
• https://git.kernel.org/stable/c/fd5f289cca04ad869b34fc9ccb647670bfdb60ac

Related Security Bulletins

• Out-of-bounds write in Linux kernel power supply driver