SB20260912321 - Unchecked Return Value in Linux kernel power supply driver

Description

This security bulletin contains information about 1 vulnerability.

1) Unchecked Return Value (CVE-ID: CVE-2026-89462)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause power-supply properties to report incorrect voltage or state-of-charge values.

The vulnerability exists due to improper error handling in the max17040 power supply driver when an I2C register read fails. A local user can access power-supply properties during a failed I2C register read to cause power-supply properties to report incorrect voltage or state-of-charge values.

A polling worker may replace the cached state of charge with an invalid value and emit a spurious change event.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/13fb0477da9b400071b9d518b24d6434c4965263
• https://git.kernel.org/stable/c/2943a0edd4865ed744702ada647921c3981207f6
• https://git.kernel.org/stable/c/659cc3d8d5ef246263873fce72c8cadeeed073cc
• https://git.kernel.org/stable/c/c7aa4c3708cc0d8487336f8281665eaea87130f6