Riskcovery

CVE-2026-89466

power: supply: qcom_battmgr: terminate the strings from firmware

State
Published
Severity
7.7 High
Published
Sep 11, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

power: supply: qcom_battmgr: terminate the strings from firmware

The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator.

Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val->strval, which power_supply_format_property() prints with "%s", so a firmware string that fills the whole field makes that read run into the following members.

Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.

Scores

CVSSScoreVectorSource
3.17.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 29e8142b5623b5949587bcc4f591c4e6595c4aca to before c06028db620854b11ad81b04b0a4e1ead930cb76Affected
  • 29e8142b5623b5949587bcc4f591c4e6595c4aca to before 0e70a9b0d16acf7adebc4f386178a95da27c0027Affected
  • 29e8142b5623b5949587bcc4f591c4e6595c4aca to before ee053561e21ce1e1741dd64ca5ddcdb92e40edc1Affected
  • 29e8142b5623b5949587bcc4f591c4e6595c4aca to before 6cc6c28c9ab6e8ecf901397717a5b391b828cdafAffected
  • 29e8142b5623b5949587bcc4f591c4e6595c4aca to before ab1112df8f4ffa88cb024dd370c432ced80f77d8Affected
LinuxLinux
  • 6.3Affected
  • before 6.3Not affected
  • 6.6.157 through 6.6.*Not affected
  • 6.12.109 through 6.12.*Not affected
  • 6.18.50 through 6.18.*Not affected
  • 7.2.4 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.