CVE-2026-80711
Received Received - Intake

power: supply: max17040 improper status handling vulnerability

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWER_SUPPLY_PROP_STATUS to a supplier power supply. If no supplier is registered, power_supply_get_property_from_supplier() returns -ENODEV and leaves the output value untouched. max17040_get_property() currently ignores that error and returns success, so userspace can read an uninitialized status value from the battery power supply. This happens on systems that use the fuel gauge without a charger supplier relationship in firmware. Return POWER_SUPPLY_STATUS_UNKNOWN when no supplier provides STATUS, and propagate other supplier lookup errors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80711
EUVD
EUVD-2026-67446

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
maxim_integrated max17040 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the MAX17040 fuel gauge driver in the Linux kernel. The driver fails to handle cases where no charger supplier is registered, leading to uninitialized status values being read by userspace. The fix ensures the driver returns POWER_SUPPLY_STATUS_UNKNOWN when no supplier provides status information.

Detection Guidance

This vulnerability affects the MAX17040 fuel gauge driver in the Linux kernel. Detection involves checking if the system uses this driver and if the power supply status is uninitialized. Inspect kernel logs for errors related to max17040 or power supply suppliers using 'dmesg | grep max17040'. Verify the driver status with 'lsmod | grep max17040' and check power supply properties via 'cat /sys/class/power_supply/BAT*/status'.

Impact Analysis

On systems using the MAX17040 fuel gauge without a charger supplier, userspace may read incorrect battery status values. This could lead to improper power management decisions, such as incorrect battery level reporting or charging state detection.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves an uninitialized status value in a battery power supply driver, which could lead to incorrect power status reporting but does not involve data privacy, security, or protected health information handling.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. If using a custom kernel, apply the fix from the upstream Linux kernel source. Ensure the MAX17040 driver correctly handles missing power supply suppliers by checking for STATUS errors in the driver code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart