CVE-2026-89471

A flaw was found in the Linux kernel's cros_usbpd-charger driver. A malicious or compromised embedded controller (EC) can report an excessive number of USB Power Delivery (PD) ports. This causes the driver to write beyond the allocated memory buffer when populating a fixed-size array for port data, leading to a slab out-of-bounds write. This memory corruption could potentially be exploited by a local attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.