A memory corruption vulnerability in the Linux kernel cros_ec_typec driver could allow a local attacker to achieve arbitrary code execution or cause a system crash.

The vulnerability exists in the cros_typec_register_partner_pdos function, which fails to validate the source and sink capability counts received from the Embedded Controller (EC). An attacker providing a malicious PD status response can trigger a stack-based buffer overflow, as the kernel does not limit these counts to the fixed array size of seven.

Successful exploitation allows an attacker to overwrite stack memory, potentially leading to a kernel panic (denial of service) or the execution of arbitrary code with elevated privileges. Given the CVSS score of 8.4, this vulnerability represents a high risk to system integrity and availability, particularly for devices utilizing the ChromeOS EC firmware interface.

Immediate Action: Update your Linux kernel to version 6.1.188, 6.6.157, 6.12.110, 6.18.52, or any later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts associated with the cros_ec_typec module.

Compensating Controls: Ensure that only trusted hardware is connected to the system, as the vulnerability requires interaction with the EC firmware interface to trigger the out-of-bounds write.

Public Exploit Available: No

This vulnerability highlights the importance of rigorous input validation even for internal kernel-to-hardware communication interfaces. Administrators should prioritize patching the kernel across all impacted hardware platforms to prevent potential privilege escalation. Apply the recommended kernel updates as part of your standard maintenance cycle to mitigate this risk.