CVE-2026-89470

The Linux kernel's cros_usbpd-charger power supply driver trusts the raw charger port count reported by the device's embedded controller (EC) during probe, with only an inadequate check against the EC's USB PD port count. A malicious or compromised EC firmware can return a port count of up to 255, causing the driver to write past the end of its port arrays, resulting in an out-of-bounds write and kernel memory corruption with potential high impact to confidentiality, integrity, and availability. The attack vector is local (the EC sits on the machine itself), so practical exploitation presupposes an attacker who can control or flash rogue EC firmware rather than a remote adversary. The flaw primarily affects ChromeOS-style systems — Chromebooks and Linux installations on hardware built around the ChromeOS embedded controller with USB-C/PD charging. No public proof of concept exists, the issue is not in CISA's KEV, and no exploitation in the wild is known; this is a defense-in-depth hardening fix.

What to do: Apply kernel updates containing the cros_usbpd-charger fix (port counts clamped to EC_USB_PD_MAX_PORTS) as soon as your distribution or ChromeOS auto-update channel ships it. Verify that EC firmware only comes from signed, vendor-approved update paths, since triggering the bug requires control of the embedded controller. Defenders should treat unexpected or unsigned EC/BIOS firmware changes on managed fleets as a high-severity signal.