CVE-2026-78119

Name of the Vulnerable Software and Affected Versions Nuvoton NPCX eSPI driver (affected versions not specified)

Description The driver fails to validate the 12-bit length field from the request header in the FLASHRXBUF FIFO when parsing Target-Attached-Flash (TAF) requests. In the espi taf parse() function, write and RPMC OP1 requests can trigger an out-of-bounds write of up to 956 bytes into the .bss section because the length is not compared against the fixed 64-byte espi taf pckt.src buffer or the negotiated eSPI receive payload size (rx-plsize). Additionally, the unvalidated length passed to flash write() in espi taf npcx flash write() can allow reading up to 4 KB of adjacent controller SRAM into SPI flash. A separate four-byte stack buffer overflow occurs in taf npcx completion handler() on SoCs with a tx-plsize of 64. This issue is reachable via the eSPI host side through requests that violate the negotiated payload size, potentially leading to controller crashes, hangs, or the corruption of driver state governing flash protection regions.

Recommendations Update the driver to widen counters and reject requests where the word count exceeds ARRAY SIZE(FLASHRXBUF) - NPCX ESPI FLASH HEADER ADDRESS LEN and NPCX TAF RX PAYLOAD WORDS. Implement the invalid flag in espi taf work() to ensure invalid packets result in an unsuccessful completion. Bound the transmit payload against FLASHTXBUF and implement a default case for unsupported cycle types. As a temporary mitigation, disable CONFIG ESPI TAF if it is enabled on the NPCX/NPCK target.