CVE-2026-89470

HighCVSS 8.4/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

Currently the cros_usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and subsequent memory corruption.

Update helper functions in cros_usbpd-charger to limit port counts to EC_USB_PD_MAX_PORTS.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 11, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-894718.4In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd-charger: bound the EC-reported port count crCVE-2026-894727.8In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysCVE-2026-89473In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power_supply reference leak bq25890_fw_proCVE-2026-89474In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb_work before freeing the charger The CVE-2026-89475In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin inteCVE-2026-894767.5In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream->outcnt underflow on duplicate RECONF responses A cacCVE-2026-894777.5In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_sCVE-2026-894789.8In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves thCVE-2026-894799.8In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_enCVE-2026-89489.1Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.CVE-2026-894807.5In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_dCVE-2026-894817.5In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tc
CVE-2026-89470: High severity, CVSS 8.4 | Vulnix