GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89466 (GCVE-0-2026-89466)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-14 12:00
VLAI
Title
power: supply: qcom_battmgr: terminate the strings from firmware
Summary
In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator. Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val->strval, which power_supply_format_property() prints with "%s", so a firmware string that fills the whole field makes that read run into the following members. Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 29e8142b5623b5949587bcc4f591c4e6595c4aca , < c06028db620854b11ad81b04b0a4e1ead930cb76 (git)
Affected: 29e8142b5623b5949587bcc4f591c4e6595c4aca , < 0e70a9b0d16acf7adebc4f386178a95da27c0027 (git)
Affected: 29e8142b5623b5949587bcc4f591c4e6595c4aca , < ee053561e21ce1e1741dd64ca5ddcdb92e40edc1 (git)
Affected: 29e8142b5623b5949587bcc4f591c4e6595c4aca , < 6cc6c28c9ab6e8ecf901397717a5b391b828cdaf (git)
Affected: 29e8142b5623b5949587bcc4f591c4e6595c4aca , < ab1112df8f4ffa88cb024dd370c432ced80f77d8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/supply/qcom_battmgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c06028db620854b11ad81b04b0a4e1ead930cb76",
              "status": "affected",
              "version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
              "versionType": "git"
            },
            {
              "lessThan": "0e70a9b0d16acf7adebc4f386178a95da27c0027",
              "status": "affected",
              "version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
              "versionType": "git"
            },
            {
              "lessThan": "ee053561e21ce1e1741dd64ca5ddcdb92e40edc1",
              "status": "affected",
              "version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
              "versionType": "git"
            },
            {
              "lessThan": "6cc6c28c9ab6e8ecf901397717a5b391b828cdaf",
              "status": "affected",
              "version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
              "versionType": "git"
            },
            {
              "lessThan": "ab1112df8f4ffa88cb024dd370c432ced80f77d8",
              "status": "affected",
              "version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/power/supply/qcom_battmgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: qcom_battmgr: terminate the strings from firmware\n\nThe qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the\nfirmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and\nleaves the destination without a terminator.\n\nThose destinations are model_number, serial_number and oem_info, each\nBATTMGR_STRING_LEN and declared next to each other. They go out to user\nspace as val-\u003estrval, which power_supply_format_property() prints with\n\"%s\", so a firmware string that fills the whole field makes that read run\ninto the following members.\n\nUse strscpy() so the copy always terminates, the way the SM8350 path\nalready does for the same field."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The unterminated copies run in qcom_battmgr_sc8280xp_callback() on BATTMGR_BAT_INFO payloads received over on-SoC PMIC GLINK/rpmsg from the Qualcomm ADSP/SOCCP (PMIC_RTR_ADSP_APPS), not from a network protocol, Bluetooth, or a pluggable USB device.\nAC:L - Firmware fully controls the 128-byte model_number, serial_number, and oem_info fields; sending 128 non-NUL bytes (or a first byte that is not a Pascal length) always takes the memcpy() path that omits the terminator, with no race or attacker-uncontrollable layout.\nPR:N - pmic_glink_rpmsg_callback delivers ADSP/SOCCP payloads to qcom_battmgr_callback with no Linux credential or capability check, so compromised PMIC firmware can send BATTMGR_BAT_INFO and NOTIF_BAT_INFO without a host account.\nUI:N - Battery-info parsing and power_supply_changed() uevents run from the GLINK response/notification path and from automatic sysfs/uevent reads at boot; no victim must open a file, mount a filesystem, or take any other action.\nS:U - The over-read stays in host kernel memory around struct qcom_battmgr in the same OS security authority; this is ordinary kernel disclosure or denial of service, not a VM escape, IOMMU bypass, or sandbox breakout.\nC:H - Unterminated model_number, serial_number, and oem_info are printed with %s via world-readable power_supply sysfs and uevents; kernel vsnprintf scans until a NUL, an unbounded out-of-bounds read of adjacent kernel fields and pointers.\nI:N - qcom_battmgr_sc8280xp_strcpy() copies exactly BATTMGR_STRING_LEN bytes into same-sized destinations; the defect is a missing terminator that causes over-reads, not an out-of-bounds write, use-after-free, or control-flow hijack primitive.\nA:H - Unbounded %s scanning of those unterminated fields can walk past the kmalloc-backed qcom_battmgr object into unmapped pages, causing a kernel oops or panic, and firmware can retrigger the path through GLINK notifications."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:05.333Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c06028db620854b11ad81b04b0a4e1ead930cb76"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e70a9b0d16acf7adebc4f386178a95da27c0027"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee053561e21ce1e1741dd64ca5ddcdb92e40edc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cc6c28c9ab6e8ecf901397717a5b391b828cdaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab1112df8f4ffa88cb024dd370c432ced80f77d8"
        }
      ],
      "title": "power: supply: qcom_battmgr: terminate the strings from firmware",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89466",
    "datePublished": "2026-09-11T19:43:26.621Z",
    "dateReserved": "2026-09-11T19:38:34.709Z",
    "dateUpdated": "2026-09-14T12:00:05.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89466",
      "date": "2026-09-15",
      "epss": "0.00144",
      "percentile": "0.03995"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:54:44.000Z",
      "cve": "CVE-2026-89466",
      "id": "msrc_CVE-2026-89466",
      "initial_release_date": "2026-09-13T01:06:37.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "power: supply: qcom_battmgr: terminate the strings from firmware",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89466.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89466\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:27.673\",\"lastModified\":\"2026-09-14T13:19:03.020\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npower: supply: qcom_battmgr: terminate the strings from firmware\\n\\nThe qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the\\nfirmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and\\nleaves the destination without a terminator.\\n\\nThose destinations are model_number, serial_number and oem_info, each\\nBATTMGR_STRING_LEN and declared next to each other. They go out to user\\nspace as val-\u003estrval, which power_supply_format_property() prints with\\n\\\"%s\\\", so a firmware string that fills the whole field makes that read run\\ninto the following members.\\n\\nUse strscpy() so the copy always terminates, the way the SM8350 path\\nalready does for the same field.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/power/supply/qcom_battmgr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"29e8142b5623b5949587bcc4f591c4e6595c4aca\",\"lessThan\":\"c06028db620854b11ad81b04b0a4e1ead930cb76\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"29e8142b5623b5949587bcc4f591c4e6595c4aca\",\"lessThan\":\"0e70a9b0d16acf7adebc4f386178a95da27c0027\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"29e8142b5623b5949587bcc4f591c4e6595c4aca\",\"lessThan\":\"ee053561e21ce1e1741dd64ca5ddcdb92e40edc1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"29e8142b5623b5949587bcc4f591c4e6595c4aca\",\"lessThan\":\"6cc6c28c9ab6e8ecf901397717a5b391b828cdaf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"29e8142b5623b5949587bcc4f591c4e6595c4aca\",\"lessThan\":\"ab1112df8f4ffa88cb024dd370c432ced80f77d8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/power/supply/qcom_battmgr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e70a9b0d16acf7adebc4f386178a95da27c0027\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6cc6c28c9ab6e8ecf901397717a5b391b828cdaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ab1112df8f4ffa88cb024dd370c432ced80f77d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c06028db620854b11ad81b04b0a4e1ead930cb76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ee053561e21ce1e1741dd64ca5ddcdb92e40edc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-13T07:01:14+00:00",
      "cve": "CVE-2026-89466",
      "id": "CVE-2026-89466",
      "initial_release_date": "2026-09-11T19:43:26.621000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Information disclosure in qcom_battmgr due to improper string termination",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89466.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-16T00:03:25Z",
      "cve": "CVE-2026-89466",
      "id": "CVE-2026-89466",
      "initial_release_date": "2026-09-12T16:28:02Z",
      "product_status:known_affected": "30",
      "product_status:known_not_affected": "323",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89466",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89466.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.