EUVD-2026-76376
GHSA-xchr-hvc5-jhvq
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the requirement for a malicious or compromised EC; AV:L is appropriate as the attack is hardware-local; no OS-level privileges are needed once the EC is controlled.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
Currently the cros_usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and subsequent memory corruption.
Update helper functions in cros_usbpd-charger to limit port counts to EC_USB_PD_MAX_PORTS.
AnalysisAI
Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of two hardware-level preconditions: (1) physical access to flash malicious EC firmware onto the target Chromebook or ChromeOS device, or (2) prior compromise of the EC firmware update mechanism via a supply-chain attack or privileged software with EC flash access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world exploitation is substantially constrained beyond what the 8.4 CVSS score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux 6.12.109, 6.18.50, or 7.2.4 per the active stable branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux kernel versions 4.20 through 6.12.x, 6.18.x, or 7.2.x in production and test environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today