CVE-2026-81017

Last refreshed2026-10-19

Status: UPDATED | Advisory ID: CVE-2026-81017

Key Details

CVE	CVE-2026-81017
CVSS Score / Version	8.4 (High) / CVSS v3.1
Updated	2026-10-19
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

platform/chrome: sensorhub: Bound the EC-reported sensor number

Each EC FIFO event carries an 8-bit sensor number (in->sensor_num).

cros_ec_sensorhub_ring_handler() validates the FIFO event count, the

per-read count and the ring bound, but not the sensor number, which

cros_ec_sensor_ring_process_event() then uses unchecked to index

sensorhub->batch_state[] - allocated with only sensorhub->sensor_num

entries. A sensor number of sensor_num or larger is an out-of-bounds

read and write of batch_state[].

Validate the sensor number in the ring handler, where each event is read

from the EC, and drop a malformed event before it is used. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-81017
CVE	https://www.cve.org/CVERecord?id=CVE-2026-81017

Source

Reference

NVD

CVE