CVE-2026-19571 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer

[
  {
    "vendor": "zephyrproject",
    "product": "zephyr",
    "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
    "packageName": "zephyr",
    "defaultStatus": "unaffected",
    "programFiles": [
      "subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c"
    ],
    "programRoutines": [
      {
        "name": "shi_ite_cs_callback"
      },
      {
        "name": "shi_ite_int_handler"
      },
      {
        "name": "shi_ite_parse_header"
      }
    ],
    "versions": [
      {
        "version": "3.3.0",
        "status": "affected",
        "lessThan": "4.5.0",
        "versionType": "semver"
      }
    ]
  }
]