CVE-2026-89470: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89470 Overview

CVE-2026-89470 is a Linux kernel vulnerability in the cros_usbpd-charger power supply driver. The driver probe iterates over charger ports using a raw count returned by the embedded controller (EC). A malicious or compromised EC can return a port count of up to 255, exceeding the EC_USB_PD_MAX_PORTS limit. The result is an out-of-bounds write and subsequent kernel memory corruption on ChromeOS-derived Linux systems that use the ChromeOS Embedded Controller USB Power Delivery interface.

Critical Impact
A malicious embedded controller can trigger an out-of-bounds write in kernel memory, leading to memory corruption and potential local privilege escalation on affected Linux systems.

Affected Products

Linux kernel builds including the cros_usbpd-charger power supply driver
ChromeOS and ChromeOS Flex systems using the ChromeOS Embedded Controller
Downstream distributions shipping the vulnerable driver prior to the fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89470 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89470

Vulnerability Analysis

The vulnerability resides in the cros_usbpd-charger driver, which manages USB Power Delivery (USB-PD) charger information reported by the ChromeOS Embedded Controller. During probe, the driver queries the EC for a charger port count and iterates over that many entries to populate its internal structures.

The driver only compares the returned count against the number of USB-PD ports, another value the same EC provides. Because both values originate from the EC, an attacker controlling the EC firmware can supply a port count larger than the fixed EC_USB_PD_MAX_PORTS bound. This causes the driver to write past the end of statically sized arrays.

The fix constrains all helper functions in cros_usbpd-charger to EC_USB_PD_MAX_PORTS, preventing indices beyond the compiled-in maximum from ever reaching backing arrays.

Root Cause

The root cause is missing input validation against a trusted-boundary limit. The driver treats EC-reported counts as trustworthy and never clamps them to the kernel-defined maximum before using them as loop bounds or array indices. This is a classic Out-of-Bounds Write [CWE-787] resulting from Improper Input Validation [CWE-20].

Attack Vector

Exploitation requires local access with the ability to influence or replace the embedded controller's responses. Realistic scenarios include a compromised or maliciously flashed EC firmware, a supply-chain implant, or a physical attacker with access to EC programming interfaces. Once the EC returns an oversized port count (up to 255), driver probe triggers out-of-bounds writes into adjacent kernel memory, which can be shaped to escalate privileges or destabilize the system.

No verified public proof-of-concept is available. See the upstream kernel commits referenced below for the fix details.

Detection Methods for CVE-2026-89470

Indicators of Compromise

Unexpected kernel panics, warnings, or KASAN reports referencing cros_usbpd_charger during device probe or resume.
Unusual EC firmware versions or unsigned EC images on ChromeOS or ChromeOS Flex hardware.
Kernel log entries from the cros_usbpd-charger driver reporting anomalous port counts above EC_USB_PD_MAX_PORTS.

Detection Strategies

Audit installed kernel versions against the fix commits (304a29ac, 3262977a, 3ce92186, 4b1f2be1, 657cd3a4, dce1750d, e951b65e, fd5f289c) on the kernel.org stable tree.
Enable KASAN in test builds to catch out-of-bounds writes during driver initialization.
Verify EC firmware integrity using vendor-signed images and measured boot attestation.

Monitoring Recommendations

Collect dmesg and journalctl -k output centrally and alert on cros_usbpd_charger errors or bounds-related warnings.
Monitor for unexpected reboots or driver reloads on affected ChromeOS-based fleets.
Track EC firmware version drift across managed devices to detect unauthorized flashing.

How to Mitigate CVE-2026-89470

Immediate Actions Required

Update affected Linux systems to a kernel version that includes the cros_usbpd-charger port-count clamping patches.
Restrict physical access to devices with ChromeOS Embedded Controllers to reduce EC tampering risk.
Enforce verified boot and signed EC firmware to prevent malicious EC images from loading.

Patch Information

The fix limits port counts in cros_usbpd-charger helper functions to EC_USB_PD_MAX_PORTS. Patches were merged into the mainline and stable kernel trees. Reference commits: 304a29ac, 3262977a, 3ce92186, 4b1f2be1, 657cd3a4, dce1750d, e951b65e, and fd5f289c.

Workarounds

Blacklist the cros_usbpd_charger module on systems that do not require USB-PD charger reporting.
Disable EC-provided USB-PD charging integration in kernel configuration on custom builds where the feature is not needed.
Apply distribution kernel updates as soon as they become available and reboot to activate the patched driver.

bash

# Blacklist the vulnerable driver until a patched kernel is deployed
echo 'blacklist cros_usbpd_charger' | sudo tee /etc/modprobe.d/blacklist-cros-usbpd.conf
sudo update-initramfs -u
sudo reboot