CVE-2026-93190 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, ChromeOS developers and maintainers, and users of Linux kernel versions affected by this vulnerability, as well as security teams and operators responsible for maintaining and securing Linux-based systems. These groups should prioritize validating PDO counts and implementing necessary fixes to prevent buffer overflow and potential code execution.

Why it matters

A buffer overflow vulnerability in the Linux kernel's platform/chrome cros_ec_typec module can lead to potential code execution and security issues. Linux kernel developers and maintainers should validate PDO counts to prevent buffer overflow and fix this vulnerability.

• Buffer overflow can lead to stack corruption and potential code execution
• Validation of PDO counts is necessary to prevent buffer overflow
• Fixing this vulnerability is crucial for maintaining the security of the Linux kernel

Technical summary

The Linux kernel's platform/chrome cros_ec_typec module has a buffer overflow vulnerability. The function cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into a fixed-size array without validating the source_cap_count and sink_cap_count fields. This can lead to a stack-based buffer overflow if either count is larger than 7, potentially resulting in code execution. Compliant ChromeOS EC firmware caps these counts, but the kernel should still validate them to ensure security. Affected Linux kernel versions should be updated with a fix.

Defensive priority

High

Recommended defensive actions

• Validate source_cap_count and sink_cap_count fields in cros_typec_register_partner_pdos()
• Implement bounds checking for PDO counts
• Update Linux kernel to version with fix
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Linux kernel's platform/chrome cros_ec_typec module has a buffer overflow vulnerability. The function cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into a fixed-size array without validating the source_cap_count and sink_cap_count fields. Compliant ChromeOS EC firmware caps these counts, but the kernel should still validate them.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.