CVE-2026-81017 (CVSS 8.4)

Description

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number (in->sensor_num). cros_ec_sensorhub_ring_handler() validates the FIFO event count, the per-read count and the ring bound, but not the sensor number, which cros_ec_sensor_ring_process_event() then uses unchecked to index sensorhub->batch_state[] - allocated with only sensorhub->sensor_num entries. A sensor number of sensor_num or larger is an out-of-bounds read and write of batch_state[]. Validate the sensor number in the ring handler, where each event is read from the EC, and drop a malformed event before it is used.

Is your site exposed to CVE-2026-81017?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.4

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.08%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/2b602ecf6193ecb9720c78b6728d7e09370b1ff1 https://git.kernel.org/stable/c/324880f94ba3c6269a607e04f78a4dd4a66b3f53 https://git.kernel.org/stable/c/3a76b87e1d065183e2e7ae5b800cb1f6e84f543d https://git.kernel.org/stable/c/3d2636dce0a8fe9eecad29010699847be425dc80 https://git.kernel.org/stable/c/4d9bf63ed74f859c6698bc01d8fb216ef9253867 https://git.kernel.org/stable/c/5eaf7faa99578ae090030d1e2e6ea3b37a615496 https://git.kernel.org/stable/c/833740a2333c2e4db4e02e3d0ffba04e8718a5f3 https://git.kernel.org/stable/c/d1b4add68dabfdd6481a4fa198bf3b473d2634d7

Frequently Asked Questions

What is CVE-2026-81017? +

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number (in->sensor_num). cros_ec_sensorhub_ring_handler() validates the FIFO event count, the per-read count and the ring bound, but not the sensor number, which cros_ec_sensor_ring_process_event() then uses unchecked to index sensorhub->batch_state[] - allocated with only sensorhub->sensor_num entries. A sensor number of sensor_num or larger is an out-of-bounds read and write of batch_state[]. Validate the sensor number in the ring handler, where each event is read from the EC, and drop a malformed event before it is used. It has a CVSS v3.1 base score of 8.4 (HIGH).

How severe is CVE-2026-81017? +

CVE-2026-81017 has a CVSS v3.1 score of 8.4 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0018, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-81017? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-81017