CVE-2026-89470 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
A malicious embedded controller can trigger an out-of-bounds write in the Linux kernel cros_usbpd-charger driver, leading to memory corruption and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89470?
CVE-2026-89470 is a high-severity memory corruption vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
Currently the cros_usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and subsequent memory corruption.
Update helper functions in cros_usbpd-charger to limit port counts to EC_USB_PD_MAX_PORTS.
Which versions are affected by CVE-2026-89470?
How do I fix CVE-2026-89470?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89470 being exploited?
There is no known exploitation of CVE-2026-89470 in the wild and no public exploit code.
Sources
Also known as AZL-100842, BELL-CVE-2026-89470, DEBIAN-CVE-2026-89470, GHSA-xchr-hvc5-jhvq, UBUNTU-CVE-2026-89470.