CVE-2026-19571

A race condition exists in the ITE IT8xxx2 SHI host-command backend (specifically in ec_host_cmd_backend_shi_ite.c) within the Zephyr RTOS. The vulnerability occurs because the driver copies the 8-byte host-command request header from the SPI Rx FIFO into the shared receive buffer (data->in_ms...