The Linux kernel cros_usbpd-charger driver reads two port counts from the embedded controller (EC): num_usbpd_ports and num_charger_ports, both u8 values. It validates that num_charger_ports is within one of num_usbpd_ports but does not check if either exceeds the fixed array size EC_USB_PD_MAX_PORTS (8). A malicious or malfunctioning EC reporting values greater than 8 (e.g., 255) passes the sanity check, causing the driver to write beyond the bounds of an 8-entry ports[] array by up to 247 entries (~1976 bytes), resulting in a slab out-of-bounds write. The fix bounds the port count to prevent overflow.

An attacker controlling or compromising the embedded controller can trigger a slab out-of-bounds write in kernel memory, potentially leading to memory corruption, system instability, or privilege escalation. However, no known exploits in the wild have been reported.

A fix has been implemented to reject EC-reported port counts larger than the fixed-size ports[] array can hold. Users should apply the updated Linux kernel version containing this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.