CVE-2026-89470 - Vulnerability Details

- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Currently the cros_usbpd-charger driver probe iterates based on raw
charger port count returned by the embedded controller. The only check
is against the number of USB PD ports which the embedded controller
also defines. A malicious embedded controller could return an inaccurate
port count (up to 255) resulting in an out of bounds write and
subsequent memory corruption.

Update helper functions in cros_usbpd-charger to limit port counts to
EC_USB_PD_MAX_PORTS.

Published: 2026-09-11

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the cros_usbpd charger driver incorrectly uses the raw port count supplied by the embedded controller to iterate over charger ports. If an attacker controls the embedded controller, they can return an inflated port count of up to bounds of its allocated memory. This out‑of‑bounds write results in kernel memory corruption (CWE‑787) and could lead to a system crash or compromise of memory integrity.

Affected Systems

Any Linux system that runs kernel versions containing the vulnerable cros_usbpd driver is affected. The products listed by the CNA are generic Linux kernel releases; the vulnerability was fixed by limiting the port count to EC_USB_PD_MAX_PORTS. Specific kernel versions affected are not disclosed in the information provided.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.4, indicating a high impact. The EPSS score is below 1%, suggesting exploitation is currently unlikely in the wild. It is not listed in the CISA KEV catalog. The likely exploit path involves a malicious or compromised embedded controller that returns a false port count. The out‑of‑bounds write in kernel space can corrupt memory and potentially allow low‑level persistence or denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< e951b65ef1699439079b723ca5c72cbe44771647
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< 3ce9218639ff62d011eb8aca0943aa670a654c7b
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< dce1750ddbd3380b1f6090dda2b07d2ebea2261d
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< 3262977a05b23d1be9fc86727a2b490ec997543e
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< fd5f289cca04ad869b34fc9ccb647670bfdb60ac
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< 4b1f2be1e1b74a50386ba718de3d62bfcf5ee701
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< 304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< 657cd3a42e937276262c0a8ae6b01a87004309de

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3af15cfacd1eef7f223802d49a88cae23c509183,fd5f289cca04ad869b34fc9ccb647670bfdb60ac)`	affected	code_commit	—
`[3af15cfacd1eef7f223802d49a88cae23c509183,4b1f2be1e1b74a50386ba718de3d62bfcf5ee701)`	affected	code_commit	—
`[3af15cfacd1eef7f223802d49a88cae23c509183,304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60)`	affected	code_commit	—
`[3af15cfacd1eef7f223802d49a88cae23c509183,657cd3a42e937276262c0a8ae6b01a87004309de)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.20`	affected	generic	—
`[0,4.20)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the vendor‑supplied kernel patch that limits port counts to EC_USB_PD_MAX_PORTS, which fixes the buffer overflow and prevents memory corruption.
Temporarily disable the cros_usbpd driver or its configuration until the patch is applied to avoid suspicious writes in the driver during the interim.
Check for updates in your distribution’s security advisories and apply the latest kernel package through the package manager to ensure the fix is installed.

Generated by OpenCVE AI on September 15, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00196.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60
https://git.kernel.org/stable/c/3262977a05b23d1be9fc86727a2b490ec997543e
https://git.kernel.org/stable/c/3ce9218639ff62d011eb8aca0943aa670a654c7b
https://git.kernel.org/stable/c/4b1f2be1e1b74a50386ba718de3d62bfcf5ee701
https://git.kernel.org/stable/c/657cd3a42e937276262c0a8ae6b01a87004309de
https://git.kernel.org/stable/c/dce1750ddbd3380b1f6090dda2b07d2ebea2261d
https://git.kernel.org/stable/c/e951b65ef1699439079b723ca5c72cbe44771647
https://git.kernel.org/stable/c/fd5f289cca04ad869b34fc9ccb647670bfdb60ac
https://nvd.nist.gov/vuln/detail/CVE-2026-89470
https://www.cve.org/CVERecord?id=CVE-2026-89470

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3262977a05b23d1be9fc86727a2b490ec997543e https://git.kernel.org/stable/c/3ce9218639ff62d011eb8aca0943aa670a654c7b https://git.kernel.org/stable/c/dce1750ddbd3380b1f6090dda2b07d2ebea2261d https://git.kernel.org/stable/c/e951b65ef1699439079b723ca5c72cbe44771647

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89470 https://www.cve.org/CVERecord?id=CVE-2026-89470
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Currently the cros_usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and subsequent memory corruption. Update helper functions in cros_usbpd-charger to limit port counts to EC_USB_PD_MAX_PORTS.
Title		power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60 https://git.kernel.org/stable/c/4b1f2be1e1b74a50386ba718de3d62bfcf5ee701 https://git.kernel.org/stable/c/657cd3a42e937276262c0a8ae6b01a87004309de https://git.kernel.org/stable/c/fd5f289cca04ad869b34fc9ccb647670bfdb60ac

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:29.206Z

Updated: 2026-09-14T12:00:07.466Z

Reserved: 2026-09-11T19:38:34.710Z

Link: CVE-2026-89470

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:28.140

Modified: 2026-09-14T13:19:03.310

Link: CVE-2026-89470

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:29Z

Links: CVE-2026-89470 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T23:00:16Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object