CVE-2026-89462

Received Received - Intake

Power Supply Register Read Error in Linux Kernel max17040

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040_get_vcell() and max17040_get_soc() ignore errors returned by regmap_read(). When an I2C transfer fails, the uninitialized register value is converted and reported to userspace as a valid voltage or state of charge. The polling worker can also replace the cached state of charge with the bogus value and emit a spurious change event. Propagate read errors through the power supply get_property callback and keep the last valid cached state of charge when polling fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-30

NVD

CVE-2026-89462

EUVD

EUVD-2026-76368

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's power supply subsystem, specifically the max17040 battery fuel gauge driver. The issue is that two functions, max17040_get_vcell() and max17040_get_soc(), do not properly handle errors from I2C register reads. When an I2C transfer fails, the functions use an uninitialized register value, which is then incorrectly reported as valid voltage or battery charge data to userspace. The cached battery state may also be updated with this invalid data, triggering false change events.

Detection Guidance

This vulnerability affects the max17040 battery fuel gauge driver in the Linux kernel. Detection requires checking kernel logs for I2C read errors or invalid power supply readings from the max17040 device. Monitor dmesg for I2C transfer failures or power supply subsystem errors. No specific commands are provided in the context.

Impact Analysis

This vulnerability could lead to incorrect battery status reporting, such as displaying wrong voltage levels or battery charge percentages. This might cause systems to take improper actions like shutting down prematurely or failing to alert users when the battery is actually low. It could also result in false notifications about battery state changes.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a Linux kernel power supply driver error propagation issue. No evidence suggests it impacts data protection or privacy controls required by these standards.

Mitigation Strategies

Apply the Linux kernel patch that propagates register read errors in the max17040 driver. Update to a kernel version containing the fix. If immediate patching is not possible, disable the max17040 driver or restrict access to the affected I2C device as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-89462. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70