CVE-2026-89466: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89466 Overview

CVE-2026-89466 is a Linux kernel vulnerability in the Qualcomm battery manager (qcom_battmgr) power supply driver. The flaw resides in qcom_battmgr_sc8280xp_strcpy(), which fails to null-terminate strings received from firmware. When firmware sends a non-Pascal string that fills the entire BATTMGR_STRING_LEN buffer, the copy leaves the destination without a terminator. The affected fields — model_number, serial_number, and oem_info — are declared adjacent in memory and exposed to user space via val->strval. A subsequent %s format in power_supply_format_property() reads past the buffer into neighboring kernel memory.

Critical Impact
Local users querying power supply properties can trigger out-of-bounds kernel memory reads, potentially disclosing sensitive kernel data or crashing the system on affected Qualcomm SC8280XP platforms.

Affected Products

Linux kernel power/supply/qcom_battmgr driver on Qualcomm SC8280XP platforms
Stable kernel branches receiving the referenced backport commits
Systems exposing battery manager sysfs properties to unprivileged users

Discovery Timeline

2026-09-11 - CVE-2026-89466 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89466

Vulnerability Analysis

The qcom_battmgr_sc8280xp_strcpy() helper handles two firmware string formats. When the firmware provides a Pascal-style string with an explicit length prefix, the function copies only the declared bytes. When the firmware provides a raw string that fills the full BATTMGR_STRING_LEN buffer, the helper copies all bytes without appending a null terminator.

The destinations model_number, serial_number, and oem_info are declared consecutively in the driver structure. An unterminated string in one field causes any string operation to continue reading into the adjacent fields and beyond. The kernel later passes these values to user space as val->strval, where power_supply_format_property() renders them with %s. The %s specifier walks memory until it encounters a null byte, producing an out-of-bounds read [CWE-125] into surrounding kernel structures.

Root Cause

The root cause is missing null termination in a driver-local string copy routine. The SM8350 code path already uses strscpy(), which guarantees termination. The SC8280XP path uses a hand-rolled copy that omits this guarantee. The fix replaces the manual copy with strscpy() so the destination is always terminated, matching the behavior of the SM8350 path.

Attack Vector

Exploitation requires local access to a system running an affected kernel on a Qualcomm SC8280XP platform. An unprivileged user reads a power supply sysfs attribute such as /sys/class/power_supply/*/model_name, triggering power_supply_format_property() and the subsequent unbounded %s read. The disclosed data may include adjacent driver state or unrelated kernel memory. In cases where the read crosses an unmapped page boundary, the resulting fault causes a kernel oops and denial of service.

The vulnerability is described in prose only; refer to the upstream fix commits 0e70a9b0, 6cc6c28c, ab1112df, c06028db, and ee053561 for the exact patch diffs.

Detection Methods for CVE-2026-89466

Indicators of Compromise

Kernel oops or general protection fault messages referencing power_supply_format_property or qcom_battmgr in dmesg
Unusual byte sequences appended to model_name, serial_number, or manufacturer sysfs reads under /sys/class/power_supply/
Repeated unprivileged reads of Qualcomm battery manager sysfs attributes from non-power-management processes

Detection Strategies

Inventory Linux kernels running on Qualcomm SC8280XP-based hardware and compare against the fixed stable branches
Audit process access patterns to /sys/class/power_supply/* and flag reads from unexpected user contexts
Enable kernel address sanitizer (KASAN) in test environments to catch the out-of-bounds read against pre-patch builds

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log store and alert on qcom_battmgr faults
Track kernel version and build hash across the fleet to confirm patch adoption on SC8280XP devices
Monitor sysfs read telemetry via auditd rules on power supply attribute paths

How to Mitigate CVE-2026-89466

Immediate Actions Required

Update to a Linux stable kernel release that includes commits 0e70a9b0, 6cc6c28c, ab1112df, c06028db, or ee053561
Prioritize patching on Qualcomm SC8280XP laptops and development boards where the driver is loaded
Restrict local user access on affected systems until the patched kernel is deployed

Patch Information

The upstream fix replaces the manual copy in qcom_battmgr_sc8280xp_strcpy() with strscpy(), guaranteeing a null terminator on every copy. The change is available in the mainline kernel and has been backported across multiple stable branches. Reference the following commits: Kernel Git Commit 0e70a9b, Kernel Git Commit 6cc6c28c, Kernel Git Commit ab1112df, Kernel Git Commit c06028db, and Kernel Git Commit ee053561.

Workarounds

Blacklist the qcom_battmgr module on systems where battery telemetry is not required
Tighten permissions on /sys/class/power_supply/* attributes to restrict reads to privileged users
Apply mandatory access control policies (SELinux or AppArmor) that limit which processes may read power supply sysfs entries

bash

# Blacklist the affected driver until patched kernel is deployed
echo "blacklist qcom_battmgr" | sudo tee /etc/modprobe.d/blacklist-qcom-battmgr.conf
sudo update-initramfs -u

# Verify the running kernel version against the patched stable release
uname -r