CVE-2026-93165

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory overread exists in the ring handler of the sensorhub component. The issue occurs because max response and sensor num are retrieved from different Embedded Controller (EC) commands. If the EC firmware malfunctions, the msg->insize (specifically fifo info length) may be clamped in the cros ec cmd xfer() function if it exceeds max response. This results in fewer bytes being read than expected, causing a subsequent memcpy() operation in the cros ec sensorhub ring handler() function to overread the resp->fifo info buffer.

Recommendations Check the return value of cros ec cmd xfer status() and abort the operation if the number of bytes read does not match the expected length.