CVE-2026-89470 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd: Limit port counts to ECUSBPDMAXPORTS Currently the crosusbpd-charger driver probe iterates based on raw charger port count returned by the embedded controller. The only check is against the number of USB...

CVE-2026-89471

CVE-2026-89471 affects the Linux kernel cros_usbpd-charger driver (power supply subsystem). The driver uses an EC-reported num_charger_ports value as a loop bound for an 8-entry fixed-size array (ports[EC_USB_PD_MAX_PORTS]) without validating it against the array size. A malicious or malfunctioni...

EUVD-2026-76377

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89470

A vulnerability in the Linux kernel's cros_usbpd-charger driver (power supply / USB power delivery) allows a malicious embedded controller to return an exaggerated charger port count (up to 255) that is not bounded by EC_USB_PD_MAX_PORTS , resulting in an out-of-bounds write and subsequent memory...

CVE-2026-89471

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89471 power: supply: cros_usbpd-charger: bound the EC-reported port count

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89466 power: supply: qcom_battmgr: terminate the strings from firmware

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: terminate the strings from firmware The qcombattmgrsc8280xpstrcpy takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGRSTRINGLEN bytes and leaves the destination...

CVE-2026-89466

CVE-2026-89466 is an out-of-bounds read in the Linux kernel's qcom_battmgr power supply driver (Qualcomm battery manager). The function qcom_battmgr_sc8280xp_strcpy() copies firmware-provided strings for model_number , serial_number , and oem_info without a null terminator when the firmware does ...

CVE-2026-89466

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: terminate the strings from firmware The qcombattmgrsc8280xpstrcpy takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGRSTRINGLEN bytes and leaves the destination...

CVE-2026-89466 power: supply: qcom_battmgr: terminate the strings from firmware

In the Linux kernel, the following vulnerability has been resolved: power: supply: qcombattmgr: terminate the strings from firmware The qcombattmgrsc8280xpstrcpy takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGRSTRINGLEN bytes and leaves the destination...

CVE-2026-89443

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

CVE-2026-89443 platform/x86: ISST: Validate level in perf mask ioctls

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

CVE-2026-89443 platform/x86: ISST: Validate level in perf mask ioctls

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

CVE-2026-89443

CVE-2026-89443 affects the Linux kernel's platform/x86 ISST (Intel Speed Select Technology) module . The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() use a user-provided level parameter as an index into perf_levels[] without first validating it against max_level, unlik...

CVE-2026-89442 platform/x86: ISST: Validate socket ID in clos_assoc ioctl

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

EUVD-2026-76348

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89442

CVE-2026-89442 affects the Linux kernel 's platform/x86 ISST (Intelligent Speed and Frequency Tuning) module. The isst_if_clos_assoc() ioctl function improperly validates the user-supplied socket_id: it uses > instead of >= against topology_max_packages(), allowing an out-of-bounds array ac...

CVE-2026-89442 platform/x86: ISST: Validate socket ID in clos_assoc ioctl

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

CVE-2026-89442

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

EUVD-2026-76344

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...