CVE-2026-89466

The Qualcomm battery manager driver (qcom_battmgr) in the Linux kernel copies firmware-supplied model_number, serial_number, and oem_info strings without guaranteeing NUL termination, so when the battery-management firmware sends a string that fills the entire BATTMGR_STRING_LEN field, the later '%s' print in power_supply_format_property() reads past the destination buffer into the adjacent struct members. Any local, unprivileged user can trigger the over-read by reading the affected power_supply sysfs attributes, which can disclose neighboring kernel heap memory (confidentiality: high) or fault the kernel and cause a denial of service (availability: high), per the CVSS 7.7 vector. The flaw is in the SC8280XP firmware path of drivers/power/supply/qcom_battmgr.c, so only systems with the BATTERY_QCOM_BATTMGR driver enabled and Qualcomm battery-manager firmware present are affected — chiefly SC8280XP/SM8350-based ARM laptops and development boards (e.g., ThinkPad X13s-class hardware) running vulnerable kernels. Because the malicious input originates from the device's own battery-management firmware, practical exploitation requires hostile or corrupted firmware, and no public proof of concept or in-the-wild exploitation is known. The fix switches the copy to strscpy() so strings are always terminated, matching the existing SM8350 code path.

What to do: Upgrade to a kernel containing the qcom_battmgr strscpy() fix, following your distribution's kernel or stable-branch advisory for the backport. To gauge exposure, confirm whether a qcom_battmgr-backed power supply exists (e.g., /sys/class/power_supply battery exposing model_number, serial_number, or oem_info); most x86 servers, desktops, and non-Qualcomm-hardware systems are unaffected because the driver is absent or unbound. Treat anomalous or corrupted battery-management firmware with suspicion, since firmware-supplied strings are the input that drives the over-read.