A heap-based buffer overflow vulnerability in the Linux kernel cros_usbpd-charger driver could allow a compromised Embedded Controller to achieve arbitrary memory corruption.

The vulnerability exists in the cros_usbpd_charger_probe function, which fails to validate the port count reported by the Embedded Controller (EC) against the fixed-size ports array. An attacker controlling the EC can supply a value exceeding the array size, leading to a slab out-of-bounds write that does not require user authentication.

Successful exploitation of this vulnerability can lead to system instability, denial of service, or potential arbitrary code execution within the kernel context. Given the CVSS score of 8.4, this flaw poses a significant risk to the integrity and availability of affected systems. Compromise at the kernel level grants the attacker complete control over the host, potentially facilitating lateral movement or data exfiltration.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later to incorporate the necessary bounds checking for the charger port count.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or irregular behavior in hardware-related drivers, particularly those involving USB Power Delivery.

Compensating Controls: Ensure that hardware components, such as the Embedded Controller, are sourced from trusted vendors and that their firmware is kept up to date to prevent malicious manipulation of low-level communication parameters.

Public Exploit Available: exploit_available (false)

This vulnerability represents a serious risk to kernel stability and security. Administrators should prioritize patching affected systems by applying the latest stable kernel updates provided by their distribution maintainers. If immediate patching is not feasible, restrict access to the physical device and monitor for any unusual hardware-level interactions that might indicate an attempt to exploit the charger driver.