High severity · published Sep 11, 2026
CVE-2026-89470
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
8.4
CVSS
0.1%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
Currently the cros_usbpd-charger driver probe iterates based on raw
charger port count returned by the embedded controller. The only check
is against the number of USB PD ports which the embedded controller
also defines. A malicious embedded controller could return an inaccurate
port count (up to 255) resulting in an out of bounds write and
subsequent memory corruption.
Update helper functions in cros_usbpd-charger to limit port counts to
EC_USB_PD_MAX_PORTS.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
3af15cfacd1eef7f223802d49a88cae23c509183 before e951b65ef1699439079b723ca5c72cbe44771647; 3af15cfacd1eef7f223802d49a88cae23c509183 before 3ce9218639ff62d011eb8aca0943aa670a654c7b; 3af15cfacd1eef7f223802d49a88cae23c509183 before dce1750ddbd3380b1f6090dda2b07d2ebea2261d; 3af15cfacd1eef7f223802d49a88cae23c509183 before 3262977a05b23d1be9fc86727a2b490ec997543e; 3af15cfacd1eef7f223802d49a88cae23c509183 before fd5f289cca04ad869b34fc9ccb647670bfdb60ac; 3af15cfacd1eef7f223802d49a88cae23c509183 before 4b1f2be1e1b74a50386ba718de3d62bfcf5ee701; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89470
git.kernel.org
https://git.kernel.org/stable/c/304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60
git.kernel.org
https://git.kernel.org/stable/c/3262977a05b23d1be9fc86727a2b490ec997543e
git.kernel.org
https://git.kernel.org/stable/c/3ce9218639ff62d011eb8aca0943aa670a654c7b
git.kernel.org
https://git.kernel.org/stable/c/4b1f2be1e1b74a50386ba718de3d62bfcf5ee701
git.kernel.org
https://git.kernel.org/stable/c/657cd3a42e937276262c0a8ae6b01a87004309de
git.kernel.org
https://git.kernel.org/stable/c/dce1750ddbd3380b1f6090dda2b07d2ebea2261d
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place