Executive brief
The Linux kernel's Chrome OS sensorhub driver processes sensor data from an embedded controller without validating sensor identifiers. A malicious or malfunctioning embedded controller can send an invalid sensor number that causes the kernel to read and write memory outside an allocated buffer, potentially corrupting kernel state or enabling privilege escalation on affected Chromebooks.
Technical details
The vulnerability is an out-of-bounds array access (CWE-129) in the Chrome OS sensorhub FIFO event handler. Each EC event carries an 8-bit sensor number that is used unchecked as an index into sensorhub->batch_state[], which is allocated with only sensorhub->sensor_num entries. The ring handler validates event count and ring bounds but not the sensor number itself. An attacker with control over the embedded controller (or an EC firmware vulnerability) can inject events with out-of-bounds sensor numbers to trigger out-of-bounds reads and writes. The fix adds sensor number bounds checking in cros_ec_sensorhub_ring_handler() before event processing. No public exploit code is known.
Affected products
- Linux Linux kernel affected versions not explicitly bounded in advisory; likely 5.10+ based on FIFO support commit from 2021
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-09-14: patched: Patch committed to stable tree