CVE-2026-80711 Overview
CVE-2026-80711 is a Linux kernel vulnerability in the max17040 power supply driver. The MAX17040 fuel gauge does not report charger state directly, so the driver forwards POWER_SUPPLY_PROP_STATUS requests to a supplier power supply. When no supplier is registered, power_supply_get_property_from_supplier() returns -ENODEV and leaves the output value untouched. The driver's max17040_get_property() function ignored that error and returned success, allowing userspace to read an uninitialized status value from the battery power supply.
Critical Impact
Userspace processes on affected systems can read uninitialized kernel stack memory through the battery status interface when the fuel gauge is used without a firmware-declared charger supplier.
Affected Products
- Linux kernel builds that include the max17040 power supply driver (drivers/power/supply/max17040.c)
- Embedded and mobile systems using the MAX17040 fuel gauge without a charger supplier relationship declared in firmware
- Distributions shipping kernels prior to the patches referenced in commits 725668c, 91ac995, b039f13, and ee2ea0c
Discovery Timeline
- 2026-08-28 - CVE-2026-80711 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80711
Vulnerability Analysis
The defect is an information disclosure through use of uninitialized memory in the max17040 battery driver. The MAX17040 integrated circuit measures battery capacity and voltage but does not expose charging state. To satisfy POWER_SUPPLY_PROP_STATUS queries from userspace, the driver delegates the read to a supplier power supply registered elsewhere in the system.
When firmware declares no supplier relationship, the delegation call fails with -ENODEV. The kernel helper power_supply_get_property_from_supplier() does not initialize the output value on this error path. Because max17040_get_property() did not check the return code before returning success, the caller received whatever stack contents happened to occupy the value union, and the sysfs or netlink status attribute exposed those bytes to userspace.
Root Cause
The root cause is missing error propagation from power_supply_get_property_from_supplier() in max17040_get_property(). The function returned 0 regardless of the supplier lookup result, and the union power_supply_propval output buffer was allocated on the stack without being zeroed. This combination produces an uninitialized read that surfaces through the power_supply class interface.
Attack Vector
A local unprivileged user reading /sys/class/power_supply/battery/status, or any process subscribed to power supply uevents, can observe uninitialized kernel memory when the driver runs without a registered supplier. The disclosure is bounded to the size of union power_supply_propval, but repeated reads across driver state transitions can reveal residual stack data from prior kernel operations.
The fix returns POWER_SUPPLY_STATUS_UNKNOWN when no supplier provides status and propagates other lookup errors to the caller. Refer to the upstream commits 725668c, 91ac995, b039f13, and ee2ea0c for the resolved patch series.
Detection Methods for CVE-2026-80711
Indicators of Compromise
- No public indicators of compromise are associated with CVE-2026-80711. Exploitation produces only local reads of the power_supply status attribute and does not leave persistent artifacts.
- Unexpected or non-standard values reported by /sys/class/power_supply/battery/status on systems using the MAX17040 fuel gauge without a charger supplier.
Detection Strategies
- Inventory Linux hosts and embedded devices that load the max17040 driver and confirm whether the running kernel includes the upstream fixes referenced above.
- Audit device tree and ACPI firmware to identify MAX17040 nodes that lack a power-supplies phandle linking to a charger supplier.
- Monitor kernel version telemetry across managed endpoints to identify unpatched builds still exposing the vulnerable code path.
Monitoring Recommendations
- Track userspace processes that repeatedly poll /sys/class/power_supply/*/status on embedded Linux systems.
- Alert on kernel package installs or downgrades that reintroduce vulnerable versions of drivers/power/supply/max17040.c.
- Include this CVE in routine vulnerability scanning for mobile and IoT Linux images that ship the MAX17040 driver.
How to Mitigate CVE-2026-80711
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 725668c, 91ac995, b039f13, and ee2ea0c to all affected builds.
- Rebuild and redeploy embedded firmware images that bundle the max17040 driver once the patched kernel is available.
- Prioritize patching for battery-powered devices where local access by unprivileged users is possible.
Patch Information
The fix modifies max17040_get_property() to return POWER_SUPPLY_STATUS_UNKNOWN when no supplier provides POWER_SUPPLY_PROP_STATUS and to propagate other supplier lookup errors. Patched sources are available in the stable kernel tree at the commits listed under Technical References. Vendors distributing long-term support kernels should backport the change to any branch that ships the max17040 driver.
Workarounds
- Declare a valid charger supplier for the MAX17040 in device tree or ACPI firmware so power_supply_get_property_from_supplier() succeeds and the uninitialized path is not reached.
- Restrict local access to /sys/class/power_supply/ where feasible until the patched kernel is deployed.
- Unload the max17040 module on systems that do not require battery status reporting, subject to platform constraints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
