CVE-2026-89466 in Linux
Summary
by MITRE • 09/12/2026
In the Linux kernel, the following vulnerability has been resolved:
power: supply: qcom_battmgr: terminate the strings from firmware
The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator.
Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val->strval, which power_supply_format_property() prints with "%s", so a firmware string that fills the whole field makes that read run into the following members.
Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in the Linux kernel power supply subsystem specifically affects the Qualcomm battery manager driver qcom_battmgr. This issue arises from improper handling of string data retrieved from firmware during system initialization or runtime operations. The core technical flaw lies within the function qcom_battmgr_sc8280xp_strcpy, which is responsible for copying strings provided by the device firmware into kernel memory buffers designated for model number, serial number, and OEM information fields. These buffers are defined with a fixed length of BATTMGR_STRING_LEN and are allocated contiguously in memory to optimize space usage within the driver's data structures.
The root cause of this vulnerability is that the qcom_battmgr_sc8280xp_strcpy function assumes incoming firmware strings may be Pascal-style, where the first byte indicates string length rather than using a null terminator. However, when the firmware provides standard C-style null-terminated strings or any other format that does not fit the expected Pascal structure, the function proceeds to copy exactly BATTMGR_STRING_LEN bytes into the destination buffer without verifying if a null terminator is present within those bounds. If the incoming string data fills the entire allocated length, no space remains for appending a terminating zero byte. Consequently, the resulting character array in memory lacks proper termination, creating an unterminated string condition that violates standard C string handling expectations and introduces significant security risks related to buffer over-reads.
The operational impact of this flaw is realized when these improperly terminated strings are exposed to user space through the power supply class interface. The kernel function power_supply_format_property utilizes a format specifier "%s" to print string properties, which inherently expects null-terminated input to determine where the string ends. When presented with an unterminated buffer, the printing routine continues reading memory beyond the intended boundary of the current field. Because the model_number, serial_number, and oem_info fields are declared adjacent to each other in memory, this over-read operation spills into neighboring data structures. This can lead to the leakage of sensitive kernel memory contents, including potentially confidential device identifiers or internal driver state information, effectively resulting in an out-of-bounds read vulnerability that compromises system integrity and confidentiality.
This issue aligns with Common Weakness Enumeration CWE-126, which describes buffer over-read vulnerabilities where software reads data past the end of a buffer. Furthermore, from a threat modeling perspective such as MITRE ATT&CK, this flaw facilitates information disclosure by allowing an attacker to extract arbitrary kernel memory contents if they can trigger the affected code path through specific firmware interactions or device configurations. The vulnerability highlights the critical importance of defensive programming practices when handling external data sources like firmware, particularly in embedded systems where resource constraints often lead to tightly packed memory layouts that amplify the consequences of boundary errors.
The resolution implemented by the Linux kernel maintainers involves replacing the unsafe copy operation with strscpy(), a safer string copying function provided by the kernel API. The strscpy() function guarantees null-termination of the destination buffer regardless of the source length, thereby preventing the over-read condition entirely. This fix mirrors the approach already used in other parts of the driver for similar fields on different hardware variants like SM8350, ensuring consistency and robustness across supported platforms. By enforcing strict termination, the patch eliminates the possibility of reading into adjacent memory regions during property formatting operations.
To mitigate this vulnerability, systems running affected kernel versions must apply the provided patch or update to a newer stable release that includes this fix. Administrators should verify their kernel version against known vulnerable ranges and prioritize updates for devices relying on Qualcomm battery management hardware. Additionally, developers working with similar firmware interfaces should adopt strscpy() or equivalent safe string handling functions instead of manual byte-counted copies without termination checks. Regular auditing of memory access patterns in drivers that interface directly with hardware firmware is recommended to prevent analogous buffer boundary violations in other subsystems.