Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-93165

platform/chrome: sensorhub: Fix memory overread in ring handler

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler `max_response` and `sensor_num` are read from different EC commands: - `max_response` is from cros_ec_get_proto_info(). ec_dev->max_response = info->max_response_packet_size - sizeof(struct ec_host_response); - `sensor_num` is from cros_ec_get_sensor_count(). sensor_num = cros_ec_get_sensor_count(ec); With a malfunctioning EC firmware, it is possible that the `msg->insize` (i.e., `fifo_info_length` in the context) could be clamped in cros_ec_cmd_xfer() because `msg->insize` is greater than `max_response`. int fifo_info_length = sizeof(struct ec_response_motion_sense_fifo_info) + sizeof(u16) * sensorhub->sensor_num; This means the number of read bytes could be less than expected. As a result, the subsequent memcpy() in cros_ec_sensorhub_ring_handler() overreads the `resp->fifo_info` buffer. Check the return value of cros_ec_cmd_xfer_status() and abort if the number of bytes read does not match the expected length.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 145d59baff5944b71551ac518d7fd7d377a9c820 to < 98604cc8fd2578442f49cd113481e8fc83bc0ad3affected
  • 145d59baff5944b71551ac518d7fd7d377a9c820 to < 86bcfab7dff6f0a61cbe0660e5176e907353141baffected
  • 145d59baff5944b71551ac518d7fd7d377a9c820 to < 7e901aaf95828364b05a2120a1bea1a1669bdc9aaffected
  • 145d59baff5944b71551ac518d7fd7d377a9c820 to < 7780d93ae28f31fe517417c9451255315d1ad584affected
  • 145d59baff5944b71551ac518d7fd7d377a9c820 to < ee0403520cdbcf87e853df9aaa9b518a0684ed38affected
  • 145d59baff5944b71551ac518d7fd7d377a9c820 to < 847a5ba0ac75f609e3f88da905251f7a76179145affected
  • 145d59baff5944b71551ac518d7fd7d377a9c820 to < 6268f46d83875d294d75b68b97a5b79953744598affected
  • 145d59baff5944b71551ac518d7fd7d377a9c820 to < d1ceb2b2324717fa30b44d56ef0c52813e239569affected

Linux Linux

Default version status: affected

  • 5.7affected
  • 0 to < 5.7unaffected
  • 5.10.270 to ≤ 5.10.*unaffected
  • 5.15.221 to ≤ 5.15.*unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.52 to ≤ 6.18.*unaffected
  • 7.2.6 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References