CVE-2026-89462

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89462", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.708Z", "datePublished": "2026-09-11T19:43:23.984Z", "dateUpdated": "2026-10-30T12:31:45.157Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:31:45.157Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: max17040: propagate register read errors\n\nmax17040_get_vcell() and max17040_get_soc() ignore errors returned by\nregmap_read(). When an I2C transfer fails, the uninitialized register\nvalue is converted and reported to userspace as a valid voltage or state\nof charge. The polling worker can also replace the cached state of charge\nwith the bogus value and emit a spurious change event.\n\nPropagate read errors through the power supply get_property callback and\nkeep the last valid cached state of charge when polling fails."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/supply/max17040_battery.c"], "versions": [{"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "abf348c40cd409db72758377f1eb6ed400c981c6", "status": "affected", "versionType": "git"}, {"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "bcdcbef9c5e69a1e79c6b9f6a3434da2f68724ed", "status": "affected", "versionType": "git"}, {"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "2943a0edd4865ed744702ada647921c3981207f6", "status": "affected", "versionType": "git"}, {"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "13fb0477da9b400071b9d518b24d6434c4965263", "status": "affected", "versionType": "git"}, {"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "c7aa4c3708cc0d8487336f8281665eaea87130f6", "status": "affected", "versionType": "git"}, {"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "659cc3d8d5ef246263873fce72c8cadeeed073cc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/supply/max17040_battery.c"], "versions": [{"version": "2.6.31", "status": "affected"}, {"version": "0", "lessThan": "2.6.31", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/abf348c40cd409db72758377f1eb6ed400c981c6"}, {"url": "https://git.kernel.org/stable/c/bcdcbef9c5e69a1e79c6b9f6a3434da2f68724ed"}, {"url": "https://git.kernel.org/stable/c/2943a0edd4865ed744702ada647921c3981207f6"}, {"url": "https://git.kernel.org/stable/c/13fb0477da9b400071b9d518b24d6434c4965263"}, {"url": "https://git.kernel.org/stable/c/c7aa4c3708cc0d8487336f8281665eaea87130f6"}, {"url": "https://git.kernel.org/stable/c/659cc3d8d5ef246263873fce72c8cadeeed073cc"}], "title": "power: supply: max17040: propagate register read errors", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/power/supply/max17040_battery.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "abf348c40cd409db72758377f1eb6ed400c981c6", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}, {"lessThan": "bcdcbef9c5e69a1e79c6b9f6a3434da2f68724ed", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}, {"lessThan": "2943a0edd4865ed744702ada647921c3981207f6", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}, {"lessThan": "13fb0477da9b400071b9d518b24d6434c4965263", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}, {"lessThan": "c7aa4c3708cc0d8487336f8281665eaea87130f6", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}, {"lessThan": "659cc3d8d5ef246263873fce72c8cadeeed073cc", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/power/supply/max17040_battery.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"lessThan": "2.6.31", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: max17040: propagate register read errors\n\nmax17040_get_vcell() and max17040_get_soc() ignore errors returned by\nregmap_read(). When an I2C transfer fails, the uninitialized register\nvalue is converted and reported to userspace as a valid voltage or state\nof charge. The polling worker can also replace the cached state of charge\nwith the bogus value and emit a spurious change event.\n\nPropagate read errors through the power supply get_property callback and\nkeep the last valid cached state of charge when polling fails."}], "id": "CVE-2026-89462", "lastModified": "2026-10-30T13:20:16.633", "metrics": {}, "published": "2026-09-11T20:19:27.157", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/13fb0477da9b400071b9d518b24d6434c4965263"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2943a0edd4865ed744702ada647921c3981207f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/659cc3d8d5ef246263873fce72c8cadeeed073cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abf348c40cd409db72758377f1eb6ed400c981c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bcdcbef9c5e69a1e79c6b9f6a3434da2f68724ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c7aa4c3708cc0d8487336f8281665eaea87130f6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Incorrect power supply status reporting due to unhandled I2C read errors in max17040 driver", "id": "2532447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532447"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["A flaw was found in the Linux kernel's power supply subsystem, specifically within the max17040 driver. This vulnerability occurs when the `max17040_get_vcell()` and `max17040_get_soc()` functions fail to properly handle errors returned by `regmap_read()` during an I2C transfer. As a result, uninitialized register values are incorrectly interpreted and reported to the user as valid voltage or state of charge. This can lead to the system displaying inaccurate power supply information and potentially triggering misleading change events, impacting the integrity of system monitoring data."], "name": "CVE-2026-89462", "public_date": "2026-09-11T19:43:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89462\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89462\nhttps://git.kernel.org/stable/c/13fb0477da9b400071b9d518b24d6434c4965263\nhttps://git.kernel.org/stable/c/2943a0edd4865ed744702ada647921c3981207f6\nhttps://git.kernel.org/stable/c/659cc3d8d5ef246263873fce72c8cadeeed073cc\nhttps://git.kernel.org/stable/c/c7aa4c3708cc0d8487336f8281665eaea87130f6"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6f4a42de60b981dd210de01cd3e575835e3158e,2943a0edd4865ed744702ada647921c3981207f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6f4a42de60b981dd210de01cd3e575835e3158e,13fb0477da9b400071b9d518b24d6434c4965263)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6f4a42de60b981dd210de01cd3e575835e3158e,c7aa4c3708cc0d8487336f8281665eaea87130f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6f4a42de60b981dd210de01cd3e575835e3158e,659cc3d8d5ef246263873fce72c8cadeeed073cc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.31"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.31)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.109,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.50,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.4,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T19:00:08.846018+00:00", "updated": "2026-09-21T01:45:07.949768+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}