Linux Kernel EUVD-2026-82298

Requires the ChromeOS Embedded Controller to report source_cap_count or sink_cap_count greater than PDO_MAX_OBJECTS (7) in its TYPEC_STATUS response, which stock ChromeOS EC firmware caps - so exploitation is limited to systems running non-compliant, buggy, or compromised EC firmware. The vulnerable path is in cros_typec_register_partner_pdos() on Chromebook hardware with the cros_ec_typec driver bound. Because the untrusted values originate from the EC (a trusted firmware component) rather than directly from the plugged-in USB-C partner or a userspace/network interface, an attacker must first control the EC firmware, which effectively requires physical/administrative subversion of the platform; there is no remote or unprivileged path in a default configuration.

The vendor CVSS of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) substantially overstates real-world risk. The flaw is a genuine stack out-of-bounds write: cros_typec_register_partner_pdos() memcpy's up to 255 u32 PDO entries into a fixed caps_desc.pdo[PDO_MAX_OBJECTS] (7-entry) stack array, overflowing by roughly 1 KB, and also reads past the 7-entry EC source arrays. However, the overflowing counts (source_cap_count/sink_cap_count) are u8 fields sourced from the ChromeOS Embedded Controller's TYPEC_STATUS response, and the description explicitly states the EC firmware caps these counts today so a compliant setup never hits the bug. This means exploitation is not attacker-driven under normal conditions - it requires a non-compliant or compromised EC supplying oversized counts, which contradicts the vendor's PR:N/AC:L rating. There is no EPSS score, no CISA KEV listing, and no public POC provided, all consistent with a defense-in-depth hardening fix rather than an exploited vulnerability. The CWE is listed as N/A but the description is unambiguously a stack buffer overflow (CWE-787/121). Net: a real memory-safety bug worth patching, but practical risk is low because the trusted data source (EC firmware) already bounds the values; treat as medium-low priority, not the critical the raw score implies.

An attacker who can run modified or non-compliant ChromeOS EC firmware (or otherwise cause the EC to report a PD capability count above 7 in its TYPEC_STATUS response) triggers cros_typec_register_partner_pdos() to memcpy past the fixed 7-entry stack array, corrupting the kernel stack and crashing the machine or potentially influencing kernel control flow. On stock ChromeOS the EC caps these counts, so this is not reachable without first subverting the EC. No public exploit code exists.