{"id":"CVE-2026-89471","title":"power: supply: cros_usbpd-charger: bound the EC-reported port count","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: cros_usbpd-charger: bound the EC-reported port count\n\ncros_usbpd_charger_probe() reads two port counts from the EC and uses\none of them, num_charger_port…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Linux","product":"Linux","affected":["Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 0b5096f6804161b61451b1cec0e38678630be849","Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < c46c9f447415ca802afab51dea1eafc08ddff1c6","Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < a1905375dfc0b9612bbee52fc066e3a70c0d671d","Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 2746d502b12b343384fb747bdef9cbcfbd7444a2","Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < fd29d08ee487f3bf50f2575aaa74f78a74b09b21","Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 78be8b7403ff7638162438b664a07d19da76059e","Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 3d1e01443b221081258ff34ea0cdd0431e4ff62e","Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 48355ce49359740f52e94d3623f6fc557ce341f0","Linux 4.19"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:47:20.319Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89471","references":[{"url":"https://git.kernel.org/stable/c/0b5096f6804161b61451b1cec0e38678630be849"},{"url":"https://git.kernel.org/stable/c/c46c9f447415ca802afab51dea1eafc08ddff1c6"},{"url":"https://git.kernel.org/stable/c/a1905375dfc0b9612bbee52fc066e3a70c0d671d"},{"url":"https://git.kernel.org/stable/c/2746d502b12b343384fb747bdef9cbcfbd7444a2"},{"url":"https://git.kernel.org/stable/c/fd29d08ee487f3bf50f2575aaa74f78a74b09b21"},{"url":"https://git.kernel.org/stable/c/78be8b7403ff7638162438b664a07d19da76059e"},{"url":"https://git.kernel.org/stable/c/3d1e01443b221081258ff34ea0cdd0431e4ff62e"},{"url":"https://git.kernel.org/stable/c/48355ce49359740f52e94d3623f6fc557ce341f0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89471.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89471"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532398"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89471"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89471"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89471.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00142,"epssPercentile":0.03449,"scores":{"cna":8.4,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.453Z","slug":"CVE-2026-89471","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: cros_usbpd-charger: bound the EC-reported port count\n\ncros_usbpd_charger_probe() reads two port counts from the EC and uses\none of them, num_charger_ports, as the loop bound when populating a\nfixed-size array:\n\n\tstruct port_data *ports[EC_USB_PD_MAX_PORTS];\t/* 8 entries */\n\t...\n\tfor (i = 0; i < charger->num_charger_ports; i++)\n\t\tcharger->ports[charger->num_registered_psy++] = port;\n\nBoth num_usbpd_ports (from EC_CMD_USB_PD_PORTS) and num_charger_ports\n(from EC_CMD_CHARGE_PORT_COUNT) are u8 values reported by the EC. The\nonly validation is a sanity check that compares the two EC-reported\nvalues against each other:\n\n\tif (num_charger_ports < num_usbpd_ports ||\n\t    num_charger_ports > num_usbpd_ports + 1)\n\t\treturn -EPROTO;\n\nIt never checks either count against EC_USB_PD_MAX_PORTS, the size of\nthe ports[] array. A malfunctioning, malicious or compromised EC that\nreports num_usbpd_ports == num_charger_ports == N for any N > 8 (for\nexample both 255) passes this check, and the loop then writes N pointers\ninto the 8-entry ports[] array embedded in the devm_kzalloc()'d\ncharger_data, overflowing it by up to 255 - 8 = 247 entries (~1976\nbytes): a slab out-of-bounds write.\n\nReject a port count larger than the ports[] array can hold.\n\n## Affected\n\n- `Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 0b5096f6804161b61451b1cec0e38678630be849`\n- `Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < c46c9f447415ca802afab51dea1eafc08ddff1c6`\n- `Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < a1905375dfc0b9612bbee52fc066e3a70c0d671d`\n- `Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 2746d502b12b343384fb747bdef9cbcfbd7444a2`\n- `Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < fd29d08ee487f3bf50f2575aaa74f78a74b09b21`\n- `Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 78be8b7403ff7638162438b664a07d19da76059e`\n- `Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 3d1e01443b221081258ff34ea0cdd0431e4ff62e`\n- `Linux >= f68b883e8fad23ed0ac4756d91594809d78678ed < 48355ce49359740f52e94d3623f6fc557ce341f0`\n- `Linux 4.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89471.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224746,"id":"CVE-2026-89471","ts":1792401518314,"field":"cvss","old":"5.5","new":"8.4"},{"seq":224745,"id":"CVE-2026-89471","ts":1792401518314,"field":"severity","old":"medium","new":"high"},{"seq":206970,"id":"CVE-2026-89471","ts":1789749723675,"field":"cvss","old":"8.4","new":"5.5"},{"seq":206969,"id":"CVE-2026-89471","ts":1789749723675,"field":"severity","old":"high","new":"medium"},{"seq":198038,"id":"CVE-2026-89471","ts":1789384321498,"field":"cvss","old":"6.4","new":"8.4"},{"seq":198037,"id":"CVE-2026-89471","ts":1789384321498,"field":"severity","old":"medium","new":"high"},{"seq":183801,"id":"CVE-2026-89471","ts":1789356677450,"field":"cvss","old":"8.4","new":"6.4"},{"seq":183800,"id":"CVE-2026-89471","ts":1789356677450,"field":"severity","old":"high","new":"medium"},{"seq":153248,"id":"CVE-2026-89471","ts":1789285349730,"field":"cvss","old":null,"new":"8.4"},{"seq":153247,"id":"CVE-2026-89471","ts":1789285349730,"field":"severity","old":"none","new":"high"},{"seq":147271,"id":"CVE-2026-89471","ts":1789270205971,"field":"cvss","old":null,"new":"6.4"},{"seq":147270,"id":"CVE-2026-89471","ts":1789270205971,"field":"severity","old":"none","new":"medium"},{"seq":109018,"id":"CVE-2026-89471","ts":1789183729981,"field":"cvss","old":null,"new":"6.4"},{"seq":109017,"id":"CVE-2026-89471","ts":1789183729981,"field":"severity","old":"none","new":"medium"}]}