CVE-2026-89471: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89471 Overview

CVE-2026-89471 is a slab out-of-bounds write vulnerability in the Linux kernel's cros_usbpd-charger power supply driver. The flaw resides in cros_usbpd_charger_probe(), which reads two port counts from the Chrome Embedded Controller (EC) and uses num_charger_ports as a loop bound when populating a fixed-size 8-entry array named ports[EC_USB_PD_MAX_PORTS]. The driver only validates the two EC-reported values against each other, never against the array size. A malicious, malfunctioning, or compromised EC that reports a port count greater than 8 can trigger a slab overflow of up to 247 pointer entries, roughly 1976 bytes, within a devm_kzalloc()-backed charger_data structure.

Critical Impact
A compromised or malfunctioning EC can trigger a kernel-slab out-of-bounds write, enabling memory corruption, denial of service, or potential local privilege escalation.

Affected Products

Linux kernel builds including the cros_usbpd-charger driver prior to the fix
ChromeOS and Chromebook-derived platforms exposing the ChromeOS EC USB-PD charger interface
Downstream distributions that ship the vulnerable drivers/power/supply/cros_usbpd-charger.c

Discovery Timeline

2026-09-11 - CVE-2026-89471 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89471

Vulnerability Analysis

The vulnerability is an Out-of-Bounds Write [CWE-787] in the ChromeOS USB Power Delivery charger driver. During probe, the driver queries the EC using EC_CMD_USB_PD_PORTS and EC_CMD_CHARGE_PORT_COUNT, obtaining num_usbpd_ports and num_charger_ports as u8 values. The driver then iterates from zero to num_charger_ports, writing pointers into the fixed-size ports[EC_USB_PD_MAX_PORTS] array embedded in charger_data. Because the array holds only 8 entries and no upper bound check is applied, any EC-reported value greater than 8 corrupts adjacent slab memory. Local unprivileged access is sufficient to reach the affected code path when the EC returns manipulated values, and successful exploitation compromises kernel confidentiality, integrity, and availability.

Root Cause

The root cause is missing input validation of EC-supplied counters. The existing sanity check only enforces num_charger_ports >= num_usbpd_ports and num_charger_ports <= num_usbpd_ports + 1. Both fields can be set to the same large value, such as 255, and still pass validation. The driver never compares either counter against EC_USB_PD_MAX_PORTS, so the loop bound remains attacker-controlled with respect to the static array size.

Attack Vector

Exploitation requires local access to a system where the kernel trusts EC-reported values during driver probe. A compromised EC firmware, a physical attacker with EC-write capability, or a malicious peripheral emulating EC responses can supply oversized port counts. When cros_usbpd_charger_probe() executes, the out-of-bounds write corrupts kernel slab memory adjacent to the charger_data allocation. The vulnerability manifests during probe, so it triggers at boot, module load, or device rebind. See the upstream fix commit for the sanitizing patch.

Detection Methods for CVE-2026-89471

Indicators of Compromise

Kernel oops, KASAN slab-out-of-bounds reports, or panic messages referencing cros_usbpd_charger_probe or cros_usbpd-charger
Unexpected EC firmware versions or checksum mismatches on ChromeOS EC images
Repeated probe or rebind cycles of the cros_usbpd-charger driver in dmesg

Detection Strategies

Enable KASAN in test kernels to catch slab out-of-bounds writes originating from the charger driver probe path
Audit boot logs for num_usbpd_ports and num_charger_ports values exceeding EC_USB_PD_MAX_PORTS (8)
Monitor for unexpected kernel module reloads targeting cros_usbpd-charger under non-administrative contexts

Monitoring Recommendations

Ship kernel logs to a centralized SIEM and alert on cros_usbpd_charger_probe errors or KASAN reports
Track EC firmware version drift across the Chromebook fleet and flag unsigned or non-vendor images
Alert on repeated -EPROTO returns from the charger driver, which may indicate probing for the vulnerable path

How to Mitigate CVE-2026-89471

Immediate Actions Required

Apply the upstream Linux kernel patch that bounds the EC-reported port count against EC_USB_PD_MAX_PORTS
Update to a distribution kernel that includes one of the referenced stable backports
Restrict physical access and enforce verified EC firmware signing on affected ChromeOS-derived devices

Patch Information

The fix rejects port counts larger than the ports[] array can hold, returning an error from cros_usbpd_charger_probe() instead of overrunning the buffer. Backports have been merged across multiple stable branches. Reference commits: 0b5096f68041, 2746d502b12b, 3d1e01443b22, 48355ce49359, 78be8b7403ff, a1905375dfc0, c46c9f447415, and fd29d08ee487.

Workarounds

Blacklist the cros_usbpd-charger module on systems where the charger driver is not required
Enforce ChromeOS verified boot and reject unsigned EC firmware to prevent tampered port counts
Restrict local and physical access to affected devices until a patched kernel is deployed

bash

# Blacklist the vulnerable module until a patched kernel is deployed
echo "blacklist cros_usbpd_charger" | sudo tee /etc/modprobe.d/cve-2026-89471.conf
sudo update-initramfs -u