Executive brief
A buffer overread vulnerability exists in the Linux kernel's ChromeOS embedded controller sensorhub driver. When the EC firmware reports conflicting sensor buffer sizes, the kernel reads fewer bytes than expected into a buffer, then copies stale memory into the sensor FIFO data structure. This could allow a local attacker with access to a malfunctioning EC device to leak sensitive kernel memory or trigger a denial of service.
Technical details
The vulnerability is a buffer overread in cros_ec_sensorhub_ring_handler() within drivers/platform/chrome/cros_ec_sensorhub_ring.c. The root cause is a size mismatch between two EC protocol parameters: max_response (from cros_ec_get_proto_info()) and sensor_num (from cros_ec_get_sensor_count()). When the expected FIFO info length exceeds max_response, the cros_ec_cmd_xfer() function clamps the input size, causing fewer bytes to be read than calculated. The subsequent memcpy() then copies uninitialized or stale buffer content. The fix validates that the returned bytes match the expected length and aborts the operation if they don't. No special privileges are required, but the attack requires a malfunctioning EC firmware to trigger the condition.
Affected products
- Linux Linux kernel affected versions unknown; patch available in stable trees
Timeline
- 2026-07-02: disclosed: Upstream commit date
- 2026-09-14: patched: Integrated into stable kernel trees