Executive brief
The Linux kernel's Qualcomm battery manager driver fails to properly null-terminate strings received from firmware, allowing unterminated string data to overflow into adjacent memory regions. When these strings are printed to userspace, the kernel reads past the intended buffer boundary, potentially exposing sensitive kernel memory or causing system instability.
Technical details
The vulnerability is a buffer over-read in the qcom_battmgr_sc8280xp_strcpy() function within the Qualcomm PMIC battery manager driver. The function copies firmware-provided strings (model_number, serial_number, oem_info) of fixed length BATTMGR_STRING_LEN bytes using memcpy() without ensuring null termination. If firmware provides a string that fills the entire buffer, power_supply_format_property() prints the unterminated string with "%s", causing the string formatter to read past the buffer boundary into adjacent kernel memory. The fix replaces memcpy() with strscpy(), which guarantees null-termination. This is a local-privilege attack requiring access to trigger battery manager operations through sysfs or similar interfaces. The vulnerability enables information disclosure of kernel memory or potential denial of service.
Affected products
- Linux Linux kernel affected versions include linux-4.x through linux-7.x
Timeline
- 2026-09-11: disclosed
- 2026-07-27: patched