The vulnerability (CVE-2026-93190) exists in the Linux kernel's cros_ec_typec driver where the function cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into a fixed-size array of 7 entries without validating that the source_cap_count and sink_cap_count fields do not exceed this limit. These counts are u8 values from the EC and only checked to not both be zero. If either count exceeds 7, the memcpy operation writes beyond the array bounds on the stack, causing a buffer overflow. This can lead to memory corruption with potential confidentiality, integrity, and availability impacts. The ChromeOS EC firmware currently limits these counts, preventing exploitation in compliant setups. The kernel patch adds validation to skip PDO registration if counts exceed PDO_MAX_OBJECTS, preventing out-of-bounds writes while continuing to handle other events.

Successful exploitation can cause a stack buffer overflow in the kernel, leading to potential arbitrary code execution, privilege escalation, or denial of service. The CVSS score of 8.4 reflects high impact on confidentiality, integrity, and availability. However, compliant ChromeOS EC firmware caps the counts, mitigating the risk in typical deployments. The vulnerability affects local attackers with low complexity and no privileges required.

A fix is available that adds validation of the source_cap_count and sink_cap_count fields in the cros_typec_register_partner_pdos() function to ensure they do not exceed the fixed array size (7). If either count is too large, PDO registration is skipped, preventing out-of-bounds memory writes. Users should apply the official Linux kernel patch that addresses this validation. Since this is not a cloud service, remediation requires updating the affected kernel version. Check the vendor advisory or Linux kernel mailing lists for the patch and update instructions.