CVE-2026-89471

In the Linux kernel, the following vulnerability has been resolved:

power: supply: cros usbpd-charger: bound the EC-reported port count

cros usbpd charger probe() reads two port counts from the EC and uses one of them, num charger ports, as the loop bound when populating a fixed-size array:

struct port data *ports[EC USB PD MAX PORTS];	/* 8 entries */
...
for (i = 0; i < charger->num charger ports; i++)
	charger->ports[charger->num registered psy++] = port;

Both num usbpd ports (from EC CMD USB PD PORTS) and num charger ports (from EC CMD CHARGE PORT COUNT) are u8 values reported by the EC. The only validation is a sanity check that compares the two EC-reported values against each other:

if (num charger ports < num usbpd ports ||
  num charger ports > num usbpd ports + 1)
	return -EPROTO;

It never checks either count against EC USB PD MAX PORTS, the size of the ports[] array. A malfunctioning, malicious or compromised EC that reports num usbpd ports == num charger ports == N for any N > 8 (for example both 255) passes this check, and the loop then writes N pointers into the 8-entry ports[] array embedded in the devm kzalloc()'d charger data, overflowing it by up to 255 - 8 = 247 entries (~1976 bytes): a slab out-of-bounds write.

Reject a port count larger than the ports[] array can hold.