Executive brief
The Linux kernel's ChromiumOS USB Power Delivery charger driver fails to validate the port count reported by the embedded controller (EC), allowing a malicious or compromised EC to trigger a buffer overflow during driver initialization. An attacker with the ability to compromise the EC firmware or spoof its responses could cause kernel memory corruption, potentially leading to privilege escalation or system crash.
Technical details
The vulnerability is an array bounds check bypass in cros_usbpd_charger_probe(). The driver reads a port count (num_charger_ports) from the EC and uses it as a loop bound to populate a fixed 8-entry array (ports[EC_USB_PD_MAX_PORTS]). Validation logic compared the count against another EC-reported value but never checked it against the actual array size. A compromised EC reporting num_charger_ports > 8 (e.g., 255) passes the relative sanity check but causes an out-of-bounds write of up to 247 pointer entries (~1976 bytes) into the heap-allocated charger_data structure. The fix adds an explicit bounds check: charger->num_charger_ports > EC_USB_PD_MAX_PORTS is now rejected with -EPROTO. The attack requires EC compromise; network attack is not possible without prior firmware compromise.
Affected products
- Linux Linux kernel affected versions depend on stable branch; driver introduced in commit f68b883e8fad and patched in commit 48355ce49359740f52e94d3623f6fc557ce341f0
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-09-14: patched: Patch committed to Linux stable tree by Greg Kroah-Hartman