CVE-2026-89470 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, cros_usbpd-charger users and deployers, and security teams responsible for vulnerability management and patching should be aware of this vulnerability and take necessary actions to verify and limit port counts in cros_usbpd-charger. Additionally, operators and administrators of affected systems should review and update their deployments to prevent potential memory corruption and denial of service.

Why it matters

A vulnerability in the Linux kernel's cros_usbpd-charger driver could allow a malicious embedded controller to return an inaccurate port count, potentially resulting in an out of bounds write and subsequent memory corruption. Linux kernel developers and maintainers should verify and limit port counts to EC_USB_PD_MAX_PORTS in cros_usbpd-charger.

• Potential memory corruption due to out of bounds write
• Possible denial of service due to memory corruption
• Need for verification of port count validation in cros_usbpd-charger

Technical summary

The cros_usbpd-charger driver in the Linux kernel does not properly validate port counts returned by the embedded controller, potentially allowing an attacker to cause an out of bounds write and memory corruption. This vulnerability can be mitigated by limiting port counts to EC_USB_PD_MAX_PORTS in cros_usbpd-charger. Affected Linux kernel developers and maintainers should review and update the driver to ensure proper validation of port counts and prevent potential memory corruption. The vulnerability highlights the importance of robust validation and input sanitization in kernel drivers.

Defensive priority

Verify and limit port counts to EC_USB_PD_MAX_PORTS in cros_usbpd-charger

Recommended defensive actions

• Verify port counts are limited to EC_USB_PD_MAX_PORTS in cros_usbpd-charger
• Review embedded controller port count validation
• Update cros_usbpd-charger to the latest version
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• whoShouldCare

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Linux kernel patch notes indicate a fix for an out of bounds write issue in the cros_usbpd-charger driver. Further review of the driver code and patch notes reveals that the fix involves limiting port counts to EC_USB_PD_MAX_PORTS. However, the exact scope of affected systems and potential impact on various deployments remains unclear. Defenders should verify port count validation in cros_usbpd-charger and review embedded controller port count limits

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.