CVE-2026-93165

Overview

A memory overread in the Linux kernel’s Chrome OS sensorhub driver can occur when the EC firmware reports a different maximum response size than the number of sensors. This mismatch causes a memcpy to read beyond the allocated buffer, potentially leading to a crash or information disclosure.

Description

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Fix memory overread in ring handler `max_response` and `sensor_num` are read from different EC commands: - `max_response` is from cros_ec_get_proto_info(). ec_dev->max_response = info->max_response_packet_size - sizeof(struct ec_host_response); - `sensor_num` is from cros_ec_get_sensor_count(). sensor_num = cros_ec_get_sensor_count(ec); With a malfunctioning EC firmware, it is possible that the `msg->insize` (i.e., `fifo_info_length` in the context) could be clamped in cros_ec_cmd_xfer() because `msg->insize` is greater than `max_response`. int fifo_info_length = sizeof(struct ec_response_motion_sense_fifo_info) + sizeof(u16) * sensorhub->sensor_num; This means the number of read bytes could be less than expected. As a result, the subsequent memcpy() in cros_ec_sensorhub_ring_handler() overreads the `resp->fifo_info` buffer. Check the return value of cros_ec_cmd_xfer_status() and abort if the number of bytes read does not match the expected length.

Impact

The overread can corrupt kernel memory, leading to system instability (availability), possible leakage of kernel data (confidentiality), and could be leveraged to gain higher privileges (integrity).

Remediation

['Apply the kernel patch that fixes CVE-2026-93165 (update to the latest kernel release).', 'Ensure the EC firmware is up‑to‑date and signed to prevent malicious firmware from causing mismatched values.', 'Configure the system to validate the return value of cros_ec_cmd_xfer_status() and abort if the read length differs from the expected size.', 'If the sensorhub is not required, disable it via kernel module options or BIOS settings.']

Risk context

High severity (CVSS 7.1). No EPSS data is available, but the vulnerability can be triggered by a compromised EC firmware. Prompt patching is recommended to avoid potential crashes or data leakage.

Affected products

• Linux kernel
• Chrome OS
• Chromebook
• Chromebox
• Chrome OS EC firmware
• Chrome OS sensorhub driver