EUVD-2026-76377

In the Linux kernel, the following vulnerability has been resolved: power: supply: crosusbpd-charger: bound the EC-reported port count crosusbpdchargerprobe reads two port counts from the EC and uses one of them, numchargerports, as the loop bound when populating a fixed-size array: struct portda...

CVE-2026-89471

CVE-2026-89471 affects the Linux kernel's cros_usbpd-charger driver (power: supply subsystem). In cros_usbpd_charger_probe(), the EC-reported num_charger_ports value is used as a loop bound to populate a fixed-size array ports[EC_USB_PD_MAX_PORTS] of 8 entries, but is never validated against that...

PT-2026-90187

In the Linux kernel, the following vulnerability has been resolved: power: supply: cros usbpd-charger: bound the EC-reported port count cros usbpd charger probe reads two port counts from the EC and uses one of them, num charger ports, as the loop bound when populating a fixed-size array: struct...