CVE-2026-89470

A flaw was found in the Linux kernel's cros_usbpd-charger driver. This driver, which manages USB power delivery, incorrectly processes port count information from an embedded controller. A malicious embedded controller could provide an exaggerated port count, leading to an out-of-bounds write and subsequent memory corruption. This vulnerability could allow an attacker to cause system instability or potentially gain unauthorized control of the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.