CVE-2026-93190

A flaw was found in the cros_ec_typec component of the Linux kernel. The cros_typec_register_partner_pdos() function does not properly validate the source_cap_count and sink_cap_count values received from the Embedded Controller (EC). An attacker could potentially provide manipulated count values, leading to a stack buffer overflow when these values are used in a memcpy operation. This could result in a denial of service or potentially arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.