CVE-2026-78119 Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash TAF requests in espitafparse drivers/espi/espinpcx.c, taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIVROUNDUPlen, 4 words into struct espitafpckt.src, a...