Executive brief
The Linux kernel's ChromeOS USB Power Delivery charger driver communicates with an embedded controller to detect charging ports. A malicious or compromised embedded controller could report an incorrect port count, causing the driver to write beyond allocated memory boundaries, leading to kernel memory corruption and potential system compromise or denial of service.
Technical details
The vulnerability exists in the cros_usbpd-charger driver's probe function, which iterates over charger ports based on a count returned by the embedded controller without proper bounds checking. An attacker with control over the embedded controller firmware could return a port count up to 255, exceeding the maximum allowed EC_USB_PD_MAX_PORTS value, resulting in an out-of-bounds write and kernel memory corruption. The fix adds explicit validation in the cros_usbpd_charger_get_num_ports() and cros_usbpd_charger_get_usbpd_num_ports() helper functions to cap port counts at EC_USB_PD_MAX_PORTS. The vulnerability requires local code execution or firmware compromise of the embedded controller, limiting the immediate attack surface.
Affected products
- Linux Linux kernel Multiple versions via cros_usbpd-charger driver
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched