EUVD-2026-76340
GHSA-9fvp-phgh-6gx2
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggering a malformed EC FIFO event from userspace is non-trivial (AC:H); at minimum a local session is required (PR:L) since direct EC FIFO injection without any privileges is unconfirmed.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
platform/chrome: sensorhub: Bound the EC-reported sensor number
Each EC FIFO event carries an 8-bit sensor number (in->sensor_num). cros_ec_sensorhub_ring_handler() validates the FIFO event count, the per-read count and the ring bound, but not the sensor number, which cros_ec_sensor_ring_process_event() then uses unchecked to index sensorhub->batch_state[] - allocated with only sensorhub->sensor_num entries. A sensor number of sensor_num or larger is an out-of-bounds read and write of batch_state[].
Validate the sensor number in the ring handler, where each event is read from the EC, and drop a malformed event before it is used.
AnalysisAI
Out-of-bounds read and write in the Linux kernel's Chrome EC sensorhub driver exposes Chromebook-class systems to kernel heap corruption via an unvalidated 8-bit sensor number in EC FIFO events. The cros_ec_sensor_ring_process_event() function indexes batch_state[] using the sensor_num field from embedded-controller events without checking it against the allocated array size, allowing any event carrying sensor_num >= sensorhub->sensor_num to access arbitrary adjacent kernel heap memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to be a Chrome EC-equipped device - primarily a Chromebook or device running the cros_ec platform driver - with the cros_ec_sensorhub kernel module loaded and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.4. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to a patched Linux kernel: 6.12.109 for the 6.12.x stable branch, 6.18.50 for 6.18.x, or 7.2.4 for 7.2.x, as confirmed by upstream stable commits. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Chromebook-class systems and verify patch availability from Google and distribution vendors. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today