CVE-2026-89461: Linux Kernel Race Condition Vulnerability

CVE-2026-89461 Overview

CVE-2026-89461 is a race condition in the Linux kernel max17040 power supply driver. The max17040_work() polling callback requeues itself after every poll cycle. During suspend, the driver calls cancel_delayed_work(), which only cancels a pending instance and does not wait for a callback that is already executing. If system suspend races with the polling callback, the callback can continue accessing the fuel gauge hardware and requeue itself after the suspend routine returns. The upstream fix replaces the call with cancel_delayed_work_sync() to ensure polling quiesces before suspend completes.

Critical Impact
A suspend-time race in the max17040 battery fuel gauge driver allows work items to access hardware after the suspend callback returns, risking undefined driver state on affected embedded and mobile Linux systems.

Affected Products

Linux kernel power: supply: max17040 driver
Systems using the MAX17040 battery fuel gauge integrated circuit
Embedded and mobile Linux devices that leverage the affected driver during suspend/resume cycles

Discovery Timeline

2026-09-11 - CVE-2026-89461 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89461

Vulnerability Analysis

The max17040 driver implements battery state polling through a delayed work item. The max17040_work() function reschedules itself at the end of each execution, creating a continuous polling loop. When the system enters suspend, the driver's suspend callback attempts to stop this polling using cancel_delayed_work().

The cancel_delayed_work() primitive only removes a queued instance from the workqueue. It returns immediately without waiting for any in-flight execution to complete. If the work callback is already running when suspend begins, cancellation reports success while the callback continues accessing I2C hardware and rearms itself once finished.

This race window allows fuel gauge access to occur after the suspend path considers the driver quiesced, potentially producing inconsistent driver state, missed wakeups, or I2C bus activity during low-power transitions.

Root Cause

The root cause is incorrect synchronization primitive selection. The driver used cancel_delayed_work() where cancel_delayed_work_sync() is required. The synchronous variant blocks until the callback has finished executing and prevents any subsequent requeue, closing the race with the suspend path.

Attack Vector

This is not a remotely exploitable flaw. Triggering the race requires local conditions where system suspend transitions coincide with the driver's polling interval. Exploitability is bounded by physical access to a device using the MAX17040 fuel gauge and the timing overlap between suspend and the periodic poll.

The vulnerability manifests as a synchronization defect rather than an attacker-controlled input path. See the upstream commits referenced in the kernel stable tree for the specific code change.

Detection Methods for CVE-2026-89461

Indicators of Compromise

Kernel log entries showing I2C access errors or fuel gauge read failures during suspend/resume cycles
Unexpected battery status reporting anomalies immediately after resume on devices using the MAX17040
Sporadic driver warnings referencing max17040 around power state transitions

Detection Strategies

Inventory Linux kernel versions across embedded and mobile assets, and correlate against the fixed commits published in the kernel stable tree
Review build configurations to determine whether CONFIG_BATTERY_MAX17040 is enabled on deployed images
Monitor dmesg output on affected hardware for repeated suspend-related driver messages

Monitoring Recommendations

Centralize kernel and power-management logs from embedded Linux fleets for anomaly detection
Track suspend/resume success metrics and error counters exposed through sysfs for MAX17040 devices
Alert on kernel panics or WARN traces originating from the power_supply subsystem

How to Mitigate CVE-2026-89461

Immediate Actions Required

Identify Linux systems built with the max17040 driver and prioritize kernel updates on those devices
Apply the stable kernel updates that include the switch to cancel_delayed_work_sync()
Validate suspend and resume behavior after patching on representative hardware

Patch Information

The fix is available across multiple stable kernel branches. Reference commits include 23783db, 36e6ce0, 5a8634a, 6bd453e, 7a9ec67, 86a3a8a, aad7247, and dc94622. Rebuild and deploy vendor kernels that incorporate these changes.

Workarounds

Disable CONFIG_BATTERY_MAX17040 in kernel builds where the fuel gauge driver is not required
Avoid suspend cycles on affected devices until a patched kernel is deployed, where operationally feasible
Increase the driver polling interval as a partial mitigation to reduce race probability, understanding this does not eliminate the defect

bash

# Verify running kernel and check for the max17040 module
uname -r
lsmod | grep max17040
zgrep BATTERY_MAX17040 /proc/config.gz