{"id":"CVE-2026-81017","title":"platform/chrome: sensorhub: Bound the EC-reported sensor number","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/chrome: sensorhub: Bound the EC-reported sensor number\n\nEach EC FIFO event carries an 8-bit sensor number (in->sensor_num).\ncros_ec_sensorhub_ring_handler() va…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 3a76b87e1d065183e2e7ae5b800cb1f6e84f543d","Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 2b602ecf6193ecb9720c78b6728d7e09370b1ff1","Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 324880f94ba3c6269a607e04f78a4dd4a66b3f53","Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < d1b4add68dabfdd6481a4fa198bf3b473d2634d7","Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 3d2636dce0a8fe9eecad29010699847be425dc80","Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 5eaf7faa99578ae090030d1e2e6ea3b37a615496","Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 4d9bf63ed74f859c6698bc01d8fb216ef9253867","Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 833740a2333c2e4db4e02e3d0ffba04e8718a5f3","Linux 5.7"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:46:42.592Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81017","references":[{"url":"https://git.kernel.org/stable/c/3a76b87e1d065183e2e7ae5b800cb1f6e84f543d"},{"url":"https://git.kernel.org/stable/c/2b602ecf6193ecb9720c78b6728d7e09370b1ff1"},{"url":"https://git.kernel.org/stable/c/324880f94ba3c6269a607e04f78a4dd4a66b3f53"},{"url":"https://git.kernel.org/stable/c/d1b4add68dabfdd6481a4fa198bf3b473d2634d7"},{"url":"https://git.kernel.org/stable/c/3d2636dce0a8fe9eecad29010699847be425dc80"},{"url":"https://git.kernel.org/stable/c/5eaf7faa99578ae090030d1e2e6ea3b37a615496"},{"url":"https://git.kernel.org/stable/c/4d9bf63ed74f859c6698bc01d8fb216ef9253867"},{"url":"https://git.kernel.org/stable/c/833740a2333c2e4db4e02e3d0ffba04e8718a5f3"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81017.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-81017"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532430"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81017"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81017"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81017.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00185,"epssPercentile":0.08013,"scores":{"cna":8.4,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.454Z","slug":"CVE-2026-81017","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nplatform/chrome: sensorhub: Bound the EC-reported sensor number\n\nEach EC FIFO event carries an 8-bit sensor number (in->sensor_num).\ncros_ec_sensorhub_ring_handler() validates the FIFO event count, the\nper-read count and the ring bound, but not the sensor number, which\ncros_ec_sensor_ring_process_event() then uses unchecked to index\nsensorhub->batch_state[] - allocated with only sensorhub->sensor_num\nentries. A sensor number of sensor_num or larger is an out-of-bounds\nread and write of batch_state[].\n\nValidate the sensor number in the ring handler, where each event is read\nfrom the EC, and drop a malformed event before it is used.\n\n## Affected\n\n- `Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 3a76b87e1d065183e2e7ae5b800cb1f6e84f543d`\n- `Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 2b602ecf6193ecb9720c78b6728d7e09370b1ff1`\n- `Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 324880f94ba3c6269a607e04f78a4dd4a66b3f53`\n- `Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < d1b4add68dabfdd6481a4fa198bf3b473d2634d7`\n- `Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 3d2636dce0a8fe9eecad29010699847be425dc80`\n- `Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 5eaf7faa99578ae090030d1e2e6ea3b37a615496`\n- `Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 4d9bf63ed74f859c6698bc01d8fb216ef9253867`\n- `Linux >= 145d59baff5944b71551ac518d7fd7d377a9c820 < 833740a2333c2e4db4e02e3d0ffba04e8718a5f3`\n- `Linux 5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81017.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224768,"id":"CVE-2026-81017","ts":1792401532206,"field":"cvss","old":"5.5","new":"8.4"},{"seq":224767,"id":"CVE-2026-81017","ts":1792401532206,"field":"severity","old":"medium","new":"high"},{"seq":204124,"id":"CVE-2026-81017","ts":1789490231802,"field":"cvss","old":"8.4","new":"5.5"},{"seq":204123,"id":"CVE-2026-81017","ts":1789490231802,"field":"severity","old":"high","new":"medium"},{"seq":183550,"id":"CVE-2026-81017","ts":1789356675846,"field":"cvss","old":"8.4","new":"6.6"},{"seq":183549,"id":"CVE-2026-81017","ts":1789356675846,"field":"severity","old":"high","new":"medium"},{"seq":153216,"id":"CVE-2026-81017","ts":1789285349586,"field":"cvss","old":null,"new":"8.4"},{"seq":153215,"id":"CVE-2026-81017","ts":1789285349586,"field":"severity","old":"none","new":"high"},{"seq":147239,"id":"CVE-2026-81017","ts":1789270203598,"field":"cvss","old":null,"new":"6.6"},{"seq":147238,"id":"CVE-2026-81017","ts":1789270203598,"field":"severity","old":"none","new":"medium"},{"seq":108992,"id":"CVE-2026-81017","ts":1789183729870,"field":"cvss","old":null,"new":"6.6"},{"seq":108991,"id":"CVE-2026-81017","ts":1789183729870,"field":"severity","old":"none","new":"medium"}]}