Cloudanix VulnDB

CVE-2026-80711

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux battery driver can hand back random leftover memory instead of a proper status when no charger is connected, letting local programs see bits of internal system data.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The max17040 fuel gauge driver ignores -ENODEV from power_supply_get_property_from_supplier() for POWER_SUPPLY_PROP_STATUS and returns success with an uninitialized value, allowing userspace to read kernel memory contents through the battery power supply sysfs interface on systems without a charger supplier.

Why it matters to the business

Systems using the max17040 driver without a firmware-defined charger supplier may leak small amounts of kernel memory to unprivileged users, increasing risk of information disclosure on embedded Linux devices such as IoT hardware or laptops that rely on this fuel gauge.

How an attack unfolds

An attacker with local access reads the battery status property via sysfs; because the driver does not initialize the output variable or return an error when no supplier exists, the uninitialized kernel stack or heap value is returned to userspace.

How to fix it

Apply the upstream fix that returns POWER_SUPPLY_STATUS_UNKNOWN when no supplier provides STATUS and propagates other lookup errors; rebuild and deploy the updated kernel.

How to confirm the fix worked

Confirm the patched driver source contains the updated max17040_get_property() logic that checks the supplier return value and sets POWER_SUPPLY_STATUS_UNKNOWN on -ENODEV; test by loading the driver without a supplier and verifying userspace receives UNKNOWN rather than uninitialized data.

Typical attack path

  1. Obtain local unprivileged shell on affected Linux system
  2. Read /sys/class/power_supply/*/status or equivalent property
  3. Observe uninitialized kernel data in the returned status value

How to detect it

Review kernel source or running driver for the pre-fix max17040_get_property() implementation that ignores supplier errors; inspect sysfs battery status reads for non-standard values on systems known to lack a charger supplier.

What your security team should do

  • Upgrade to a kernel containing the referenced max17040 fix at the earliest maintenance window
  • Audit device trees and firmware for missing charger supplier relationships on max17040-based hardware
  • Monitor for future CVEs in power supply drivers given the family pattern

The record

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWER_SUPPLY_PROP_STATUS to a supplier power supply. If no supplier is registered, power_supply_get_property_from_supplier() returns -ENODEV and leaves the output value untouched. max17040_get_property() currently ignores that error and returns success, so userspace can read an uninitialized status value from the battery power supply. This happens on systems that use the fuel gauge without a charger supplier relationship in firmware. Return POWER_SUPPLY_STATUS_UNKNOWN when no supplier provides STATUS, and propagate other supplier lookup errors.

Affected packages

Ecosystem Package Introduced Fixed