CVE-2026-81017

The Linux kernel's Chrome OS embedded-controller (EC) sensor hub driver fails to validate the 8-bit sensor number carried in each EC FIFO event before using it to index sensorhub->batch_state[], an array allocated with only sensorhub->sensor_num entries. A sensor number at or above sensor_num causes an out-of-bounds read and write of kernel memory in cros_ec_sensor_ring_process_event(). Realistically, this is triggered by an EC that emits malformed sensor events — for example, compromised or buggy EC firmware, or a malicious component on the EC side — and could yield kernel memory corruption usable for privilege escalation, information disclosure, or a crash (denial of service), consistent with the high local CVSS 8.4 rating. All Linux kernel versions carrying the vulnerable cros_ec sensorhub ring handler code are affected, which in practice means primarily ChromeOS/Chromebook devices and other hardware built on the cros_ec framework that have EC-attached motion sensors. No public proof of concept is known and the issue is not listed in CISA's KEV, so exploitation status is none known.

What to do: Update to a kernel release containing the upstream fix once your distribution or ChromeOS channel ships it; ChromeOS devices receive the patch through normal automatic OS updates, so verify devices are current. For embedded or custom Linux builds using the cros_ec framework, backport the patch that bounds-checks the EC-reported sensor number and drops malformed events. Practical risk is limited because triggering the bug requires the EC itself to emit out-of-range sensor events, but the fix is small and cheap and should be applied on any fleet where EC firmware integrity cannot be fully assured.