CVE-2026-89462 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux-based systems relying on max17040 power supply functionality should assess exposure and verify the fix.

Why it matters

A vulnerability in the Linux kernel's power supply driver for max17040 could lead to incorrect state of charge values being reported and spurious change events being emitted. Defenders should assess exposure and verify the fix.

• Defenders should verify the fix in Linux kernel deployments, especially in environments relying on max17040 power supply functionality.
• The bogus state of charge values could lead to incorrect monitoring and alerting.
• The spurious change events could cause unnecessary system reactions.

Technical summary

The max17040_get_vcell() and max17040_get_soc() functions in the Linux kernel's power supply driver ignored errors returned by regmap_read(). This could lead to bogus state of charge values being reported to userspace and spurious change events being emitted. The fix propagates read errors through the power supply get_property callback and keeps the last valid cached state of charge when polling fails.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify the fix, especially in deployments relying on max17040 power supply functionality.

Recommended defensive actions

• Review and apply the patches provided in the Linux kernel Git repository to address the vulnerability.
• Verify the fix in the Linux kernel deployments, especially in environments relying on max17040 power supply functionality.
• Monitor for potential spurious change events caused by the bogus state of charge values.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Four source references from the Linux kernel Git repository are available, detailing the patches applied to address the issue. The fix involves propagating read errors through the power supply get_property callback and keeping the last valid cached state of charge when polling fails. Linux kernel maintainers, Linux distribution maintainers, and users of Linux-based systems relying on max17040 power supply functionality should assess exposure and verify the fix. The bog

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.