CVE-2026-89462 Overview
CVE-2026-89462 affects the Linux kernel's max17040 power supply driver. The functions max17040_get_vcell() and max17040_get_soc() ignore return values from regmap_read(). When an Inter-Integrated Circuit (I2C) transfer fails, the driver converts an uninitialized register value and reports it to userspace as a valid battery voltage or state of charge.
The polling worker can also overwrite the cached state of charge with a bogus value and emit a spurious change event. The fix propagates read errors through the power supply get_property callback and preserves the last valid cached state of charge when polling fails.
Critical Impact
Userspace consumers receive fabricated battery telemetry derived from uninitialized memory, causing incorrect power management decisions and spurious events when I2C transactions fail.
Affected Products
- Linux kernel max17040 fuel gauge power supply driver
- Systems using MAX17040/MAX17041 battery fuel gauge ICs over I2C
- Multiple stable kernel branches referenced by the four upstream fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89462 published to the National Vulnerability Database (NVD)
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89462
Vulnerability Analysis
The defect is an uninitialized memory use issue in the max17040 battery fuel gauge driver. Both max17040_get_vcell() and max17040_get_soc() call regmap_read() to fetch register values over I2C but discard the returned error code. On an I2C transfer failure, the destination variable retains its uninitialized stack contents.
The driver then performs arithmetic conversion on that uninitialized value and returns it as a valid voltage reading or state-of-charge percentage. Userspace battery services and power management daemons consume the fabricated value through the sysfs power supply interface.
A secondary impact occurs in the polling worker, which caches the state of charge for later queries. When a poll cycle fails, the worker overwrites the previously valid cached value with the garbage reading and emits a POWER_SUPPLY change uevent. Downstream consumers observe a spurious battery state transition that never occurred on the hardware.
Root Cause
The root cause is missing return-value checking on regmap_read() calls. The driver treats register reads as infallible even though the underlying I2C bus can fail from noise, arbitration loss, or a disconnected device. Without propagating the error, the code path proceeds with stack-resident garbage as if it were a valid register value.
Attack Vector
This vulnerability is not remotely exploitable. Triggering the flaw requires I2C bus failures on a system with a MAX17040-family fuel gauge. Consequences are limited to incorrect battery reporting, faulty low-power decisions, and misleading uevents rather than memory corruption or privilege escalation.
No public proof-of-concept exists. See the upstream fix commits for the exact code change: commit 13fb0477, commit 2943a0ed, commit 659cc3d8, and commit c7aa4c37.
Detection Methods for CVE-2026-89462
Indicators of Compromise
- Sudden, physically implausible jumps in /sys/class/power_supply/*/voltage_now or capacity values reported by the max17040 driver.
- Repeated I2C error messages in dmesg referencing the fuel gauge address alongside battery change uevents.
- Power management daemons logging inconsistent state-of-charge transitions without corresponding hardware changes.
Detection Strategies
- Compare successive battery telemetry samples for out-of-range deltas that exceed hardware discharge or charge rates.
- Correlate kernel I2C transfer failure logs with POWER_SUPPLY uevents to identify cases where errors coincide with reported state changes.
- Audit kernel package versions on affected devices to confirm whether patched stable releases are installed.
Monitoring Recommendations
- Forward dmesg and udev events from embedded and laptop fleets to a centralized log store for anomaly review.
- Track kernel build strings and driver module versions in configuration management inventories.
- Alert on power_supply sysfs values transitioning outside vendor-specified thresholds.
How to Mitigate CVE-2026-89462
Immediate Actions Required
- Update to a Linux kernel version that includes the four referenced upstream fix commits for the max17040 driver.
- Rebuild and redeploy custom kernels used on embedded platforms and Internet of Things (IoT) devices that ship with MAX17040-family fuel gauges.
- Verify battery telemetry accuracy after patching by comparing reported values against known reference measurements.
Patch Information
The fix is available in the mainline and stable Linux kernel trees through commits 13fb0477, 2943a0ed, 659cc3d8, and c7aa4c37. The patches propagate regmap_read() errors through the get_property callback and retain the last valid cached state of charge when polling fails.
Workarounds
- Unload the max17040 module on systems that do not require software battery telemetry, if hardware design permits.
- Configure power management userspace to reject implausible voltage or capacity samples until the kernel is patched.
- Reduce polling frequency to limit exposure to spurious cached values on unpatched systems.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
