CVE-2026-93165 Linux CVE debrief

Who should care

Defenders responsible for maintaining the Linux kernel and EC firmware should be aware of this vulnerability and take necessary actions to prevent potential memory overread issues.

Why it matters

A memory overread vulnerability in the Linux kernel's platform/chrome sensorhub requires defenders to verify EC firmware integrity, ensure Linux kernel updates, and monitor system logs to prevent potential issues.

• Verify EC firmware integrity to prevent potential memory overread issues
• Ensure Linux kernel updates to prevent exploitation
• Monitor system logs for potential memory overread issues
• Assess exposure of Linux kernel and EC firmware configurations

Technical summary

The vulnerability arises from `max_response` and `sensor_num` being read from different EC commands, potentially causing the `msg->insize` to be clamped in `cros_ec_cmd_xfer()`. This could result in the subsequent `memcpy()` in `cros_ec_sensorhub_ring_handler()` overreading the `resp->fifo_info` buffer. The issue affects the Linux kernel's platform/chrome sensorhub, and defenders should prioritize verifying the integrity of the EC firmware and ensuring that the Linux kernel is updated with the necessary patches to prevent potential memory overread issues.

Defensive priority

Defenders should prioritize verifying the integrity of the EC firmware and ensuring that the Linux kernel is updated with the necessary patches to prevent potential memory overread issues.

Recommended defensive actions

• Verify the integrity of the EC firmware
• Ensure that the Linux kernel is updated with the necessary patches
• Monitor system logs for potential memory overread issues
• Assess exposure of Linux kernel and EC firmware configurations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by checking the return value of `cros_ec_cmd_xfer_status()` and aborting if the number of bytes read does not match the expected length. This fix ensures that the memcpy() in cros_ec_sensorhub_ring_handler() does not overread the resp->fifo_info buffer. Defenders should verify EC firmware integrity, ensure Linux kernel updates, and monitor system logs to prevent potential issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.