In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The… (CVE-2026-89466)
A vulnerability in the Linux kernel's Qualcomm battery manager (qcom_battmgr) was resolved by ensuring strings copied from firmware are properly null-terminated. The issue involved the qcom_battmgr_sc8280xp_strcpy() function copying firmware strings without guaranteeing termination, potentially causing out-of-bounds reads when user space prints these strings. The fix replaces the unsafe copy with strscpy(), which always null-terminates the destination string.
AI Analysis
Technical Summary
The Linux kernel's power supply Qualcomm battery manager (qcom_battmgr) had a vulnerability where the function qcom_battmgr_sc8280xp_strcpy() copied Pascal-style strings from firmware without ensuring null termination if the firmware string filled the entire BATTMGR_STRING_LEN buffer. This affected the model_number, serial_number, and oem_info fields, which are adjacent and exposed to user space as val->strval. When printed with "%s" by power_supply_format_property(), this could cause reads beyond the intended string boundary. The vulnerability was fixed by replacing the copy with strscpy(), which guarantees null termination, aligning with the approach already used in the SM8350 path.
Potential Impact
The vulnerability could cause user space processes to read beyond the intended string boundaries when accessing certain battery manager properties, potentially leading to information disclosure or memory corruption. However, no active exploits are known, and the impact is limited to improper string termination leading to out-of-bounds reads.
Mitigation Recommendations
A fix is available that replaces the unsafe string copy with strscpy(), ensuring proper null termination of firmware strings. Users should apply the official Linux kernel update that includes this patch. No additional mitigation is required once the patch is applied.
In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The… (CVE-2026-89466)
Description
A vulnerability in the Linux kernel's Qualcomm battery manager (qcom_battmgr) was resolved by ensuring strings copied from firmware are properly null-terminated. The issue involved the qcom_battmgr_sc8280xp_strcpy() function copying firmware strings without guaranteeing termination, potentially causing out-of-bounds reads when user space prints these strings. The fix replaces the unsafe copy with strscpy(), which always null-terminates the destination string.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's power supply Qualcomm battery manager (qcom_battmgr) had a vulnerability where the function qcom_battmgr_sc8280xp_strcpy() copied Pascal-style strings from firmware without ensuring null termination if the firmware string filled the entire BATTMGR_STRING_LEN buffer. This affected the model_number, serial_number, and oem_info fields, which are adjacent and exposed to user space as val->strval. When printed with "%s" by power_supply_format_property(), this could cause reads beyond the intended string boundary. The vulnerability was fixed by replacing the copy with strscpy(), which guarantees null termination, aligning with the approach already used in the SM8350 path.
Potential Impact
The vulnerability could cause user space processes to read beyond the intended string boundaries when accessing certain battery manager properties, potentially leading to information disclosure or memory corruption. However, no active exploits are known, and the impact is limited to improper string termination leading to out-of-bounds reads.
Mitigation Recommendations
A fix is available that replaces the unsafe string copy with strscpy(), ensuring proper null termination of firmware strings. Users should apply the official Linux kernel update that includes this patch. No additional mitigation is required once the patch is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g9cw-qg44-9g2q
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89466"]
Threat ID: 6aa4a02155bf5e2cf5a8699a
Added to database: 09/12/2026, 00:43:13 UTC
Last enriched: 09/12/2026, 01:15:50 UTC
Last updated: 09/12/2026, 01:15:50 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.