CVE-2026-78119

The Nuvoton NPCX eSPI driver contains an out-of-bounds write vulnerability in the espi_taf_parse() function located in drivers/espi/espi_npcx.c. The driver fails to validate a 12-bit length field from the FLASHRXBUF FIFO header, leading to a copy operation that can exceed the 64-byte espi_taf_pck...

CVE-2026-78119 Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash TAF requests in espitafparse drivers/espi/espinpcx.c, taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIVROUNDUPlen, 4 words into struct espitafpckt.src, a...