The Linux kernel cros_usbpd-charger driver previously iterated over a raw charger port count returned by the embedded controller with insufficient validation. The only check was against the number of USB PD ports defined by the embedded controller. A malicious embedded controller could exploit this by returning an inaccurate port count, up to 255, leading to an out-of-bounds write and memory corruption. The fix updates helper functions to limit port counts to EC_USB_PD_MAX_PORTS, preventing this out-of-bounds condition.

A malicious embedded controller could cause memory corruption in the Linux kernel by reporting an inaccurate port count, potentially leading to system instability or security issues related to memory corruption. No known exploits in the wild have been reported.

The vulnerability has been resolved by updating the cros_usbpd-charger driver to limit port counts to EC_USB_PD_MAX_PORTS. Users should apply the official Linux kernel updates containing this fix. No additional mitigation steps are indicated.