CVE-2026-80711 PUBLISHED

power: supply: max17040: handle missing status supplier

Assigner: Linux
Reserved: 26.08.2026 Published: 28.08.2026 Updated: 28.08.2026

In the Linux kernel, the following vulnerability has been resolved:

power: supply: max17040: handle missing status supplier

MAX17040 does not report charger state itself, so the driver forwards POWER_SUPPLY_PROP_STATUS to a supplier power supply. If no supplier is registered, power_supply_get_property_from_supplier() returns -ENODEV and leaves the output value untouched.

max17040_get_property() currently ignores that error and returns success, so userspace can read an uninitialized status value from the battery power supply. This happens on systems that use the fuel gauge without a charger supplier relationship in firmware.

Return POWER_SUPPLY_STATUS_UNKNOWN when no supplier provides STATUS, and propagate other supplier lookup errors.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e to 91ac995a6f4ddf4f92b231b080544abf23a9b871 (excl.)
  • affected from f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e to b039f13e095d28a64ca6b21d0ee5440d8b048f37 (excl.)
  • affected from f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e to ee2ea0c452edc0930e7395b080dccd5a1cb965e1 (excl.)
  • affected from f4b782af61ae7bbf93008d5809b0e3a8ac2bb88e to 725668c6b6aa3971fe850659102c250d0d676e18 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.7 is affected
  • unaffected from 0 to 6.7 (excl.)
  • unaffected from 6.12.103 to 6.12.* (incl.)
  • unaffected from 6.18.44 to 6.18.* (incl.)
  • unaffected from 7.1.8 to 7.1.* (incl.)
  • unaffected from 7.2 to * (incl.)

References