CVE-2026-81017

In the Linux kernel, the following vulnerability has been resolved:

platform/chrome: sensorhub: Bound the EC-reported sensor number

Each EC FIFO event carries an 8-bit sensor number (in->sensor num). cros ec sensorhub ring handler() validates the FIFO event count, the per-read count and the ring bound, but not the sensor number, which cros ec sensor ring process event() then uses unchecked to index sensorhub->batch state[] - allocated with only sensorhub->sensor num entries. A sensor number of sensor num or larger is an out-of-bounds read and write of batch state[].

Validate the sensor number in the ring handler, where each event is read from the EC, and drop a malformed event before it is used.