SB20260912320 - Race condition in Linux kernel power supply driver

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-89461)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the polling callback to continue accessing the fuel gauge after system suspend.

The vulnerability exists due to improper synchronization in the max17040 fuel-gauge driver's suspend handler when system suspend races with the polling callback. A remote attacker can cause system suspend to race with the polling callback to cause the polling callback to continue accessing the fuel gauge after system suspend.

The polling work requeues itself after each poll.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/36e6ce0f402f965328b27fd31ac793110e8a0c39
• https://git.kernel.org/stable/c/5a863417fb9a1034ab1cfe4fa0de46ce1f95f3ec
• https://git.kernel.org/stable/c/86a3a8a926aa5969c329d1df2d3259f189961bbc
• https://git.kernel.org/stable/c/aad7247bd35ad44af90a5e8974cdff614235b497