Executive brief
A vulnerability in the ChromeOS embedded controller USB Type-C driver can allow a malicious or malfunctioning embedded controller to cause a kernel crash or potential code execution by providing an out-of-bounds power delivery capability count. The driver handles USB Type-C power delivery negotiation on ChromeOS devices, and a stack buffer overflow could impact system stability or device security.
Technical details
The cros_typec_register_partner_pdos() function in drivers/platform/chrome/cros_ec_typec.c performs two memcpy operations copying partner power delivery objects (PDOs) from an EC response into a fixed-size stack array (PDO_MAX_OBJECTS = 7). The source_cap_count and sink_cap_count fields from the EC response are u8 values (0–255) and were only checked to ensure both were not zero. If either count exceeded 7, memcpy would write past the stack buffer boundary by up to ~1 KB, enabling stack corruption. The EC may also read past its own source arrays if the count is out of bounds. The fix adds explicit validation to reject counts exceeding PDO_MAX_OBJECTS before the memcpy calls. This is a local kernel vulnerability requiring EC compromise or a supply-chain attack on the embedded controller firmware.
Affected products
- Linux Linux Kernel Affected versions prior to patch commit a0a8cd9fc9c48b95095bcec4b146f7a99486f58e; backported to stable series
Timeline
- 2026-09-17: disclosed: CVE-2026-93190 published
- 2026-06-25: patched: Upstream patch committed (a0a8cd9fc9c48b95095bcec4b146f7a99486f58e)
- 2026-09-14: patched: Backported to stable kernels