CVE-2026-89470 - Vulnerability Details

- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Currently the cros_usbpd-charger driver probe iterates based on raw
charger port count returned by the embedded controller. The only check
is against the number of USB PD ports which the embedded controller
also defines. A malicious embedded controller could return an inaccurate
port count (up to 255) resulting in an out of bounds write and
subsequent memory corruption.

Update helper functions in cros_usbpd-charger to limit port counts to
EC_USB_PD_MAX_PORTS.

Published: 2026-09-11

Score: 8.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

USB‑PD charger driver fails to enforce a hard limit on the number of USB ports. The driver iterates using the raw port count supplied by the embedded controller, allowing a malicious controller to provide a value up to 255. This causes an out‑of‑bounds write that corrupts memory, resulting in kernel memory corruption and potential system crash or (CWE‑787) that permits memory corruption.

Affected Systems

Impact is confined to Linux kernel distributions running the cros_usbpd charger driver. Systems employing the embedded controller firmware that can report a false port count are susceptible. The vulnerability was addressed by limiting the port count to EC_USB_PD_MAX_PORTS in the kernel source. Resources list only Linux:Linux; specific kernel versions are not provided in the data.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.4, indicating a moderate risk level. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a compromised or malicious embedded controller that can manipulate the reported port count. An out‑of‑bounds write in kernel space can lead to memory corruption and potentially cause a system crash or instability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< fd5f289cca04ad869b34fc9ccb647670bfdb60ac
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< 4b1f2be1e1b74a50386ba718de3d62bfcf5ee701
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< 304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60
`3af15cfacd1eef7f223802d49a88cae23c509183`	affected	< 657cd3a42e937276262c0a8ae6b01a87004309de

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3af15cfacd1eef7f223802d49a88cae23c509183,fd5f289cca04ad869b34fc9ccb647670bfdb60ac)`	affected	code_commit	—
`[3af15cfacd1eef7f223802d49a88cae23c509183,4b1f2be1e1b74a50386ba718de3d62bfcf5ee701)`	affected	code_commit	—
`[3af15cfacd1eef7f223802d49a88cae23c509183,304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60)`	affected	code_commit	—
`[3af15cfacd1eef7f223802d49a88cae23c509183,657cd3a42e937276262c0a8ae6b01a87004309de)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.20`	affected	generic	—
`[0,4.20)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the vendor‑supplied kernel patch that fixes the buffer overflow (CWE‑787) by limiting port counts to EC_USB_PD_MAX_PORTS.
Disable the cros_usbpd driver (or its configuration) until the patch is available.
Enable kernel logging or audit for anomalous writes around the driver if upgrade is delayed.

Generated by OpenCVE AI on September 13, 2026 at 03:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60
https://git.kernel.org/stable/c/4b1f2be1e1b74a50386ba718de3d62bfcf5ee701
https://git.kernel.org/stable/c/657cd3a42e937276262c0a8ae6b01a87004309de
https://git.kernel.org/stable/c/fd5f289cca04ad869b34fc9ccb647670bfdb60ac
https://nvd.nist.gov/vuln/detail/CVE-2026-89470
https://www.cve.org/CVERecord?id=CVE-2026-89470

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89470 https://www.cve.org/CVERecord?id=CVE-2026-89470
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Currently the cros_usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and subsequent memory corruption. Update helper functions in cros_usbpd-charger to limit port counts to EC_USB_PD_MAX_PORTS.
Title		power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/304a29ac55ba3ee6eceaf7d83d09cd9709f3bf60 https://git.kernel.org/stable/c/4b1f2be1e1b74a50386ba718de3d62bfcf5ee701 https://git.kernel.org/stable/c/657cd3a42e937276262c0a8ae6b01a87004309de https://git.kernel.org/stable/c/fd5f289cca04ad869b34fc9ccb647670bfdb60ac

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:29.206Z

Updated: 2026-09-13T06:29:40.352Z

Reserved: 2026-09-11T19:38:34.710Z

Link: CVE-2026-89470

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:28.140

Modified: 2026-09-13T07:17:10.263

Link: CVE-2026-89470

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:29Z

Links: CVE-2026-89470 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T05:30:06Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object