CVE-2026-89466: power: supply: qcom_battmgr: terminate the strings from firmware
In the Linux kernel, the following vulnerability has been resolved:
power: supply: qcombattmgr: terminate the strings from firmware
The qcombattmgrsc8280xpstrcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGRSTRINGLEN bytes and leaves the destination without a terminator.
Those destinations are modelnumber, serialnumber and oeminfo, each BATTMGRSTRINGLEN and declared next to each other. They go out to user space as val->strval, which powersupplyformatproperty() prints with "%s", so a firmware string that fills the whole field makes that read run into the following members.
Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.
Affected Software
Event History
Frequently Asked Questions
Which deployments are potentially exposed?
Systems using the Linux kernel qcom_battmgr SC8280XP path are potentially exposed when they obtain battery-management string fields from firmware. The affected fields are model_number, serial_number, and oem_info.
What input condition causes the out-of-bounds read?
A firmware-provided string that fills an entire BATTMGR_STRING_LEN field without a terminator can leave the copied destination unterminated. When that value is later formatted for user space with %s, the read can continue into adjacent fields.
What would an attacker need to influence?
Exploitation requires influence over a firmware-provided battery-management string such that it occupies the full field length and lacks a terminating byte. The issue is exposed when the affected property is exported to user space.