In the Linux kernel, the following vulnerability has been resolved:

power: supply: cros usbpd: Limit port counts to EC USB PD MAX PORTS

Currently the cros usbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB PD ports which the embedded controller also defines. A malicious embedded controller could return an inaccurate port count (up to 255) resulting in an out of bounds write and subsequent memory corruption.

Update helper functions in cros usbpd-charger to limit port counts to EC USB PD MAX PORTS.