CVE-2026-89462: power: supply: max17040: propagate register read errors
In the Linux kernel, the following vulnerability has been resolved:
power: supply: max17040: propagate register read errors
max17040getvcell() and max17040getsoc() ignore errors returned by regmapread(). When an I2C transfer fails, the uninitialized register value is converted and reported to userspace as a valid voltage or state of charge. The polling worker can also replace the cached state of charge with the bogus value and emit a spurious change event.
Propagate read errors through the power supply getproperty callback and keep the last valid cached state of charge when polling fails.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel MAX17040 power-supply driver are exposed when the driver reads battery voltage or state of charge through I2C. The issue is triggered by failed I2C transfers during register reads.
What is the operational impact of a failed read?
Before the fix, an uninitialized register value could be converted and reported to userspace as a valid battery voltage or state-of-charge value. A polling failure could also overwrite the cached state of charge and generate a spurious power-supply change event.
How can affected behavior be identified?
Look for battery voltage or state-of-charge readings that are implausible or inconsistent with prior readings, particularly when I2C transfer failures occur. Spurious power-supply change events during such failures are another indicator.
What changes after applying the resolution?
Register read errors are returned through the power-supply get_property callback instead of being reported as valid measurements. When polling fails, the driver retains the last valid cached state of charge rather than replacing it with a bogus value.