CVE-2026-80711

A flaw was found in the Linux kernel's power supply subsystem, specifically within the MAX17040 fuel gauge driver. When the MAX17040 fuel gauge operates without a registered charger status supplier, the driver fails to properly handle this missing information. This oversight can result in userspace applications reading an uninitialized battery status value, leading to incorrect battery state reporting.

A moderate severity flaw was found in the Linux kernel power supply subsystem, specifically in the MAX17040 fuel gauge driver. The MAX17040 device does not report charger state itself, so the driver forwards POWER_SUPPLY_PROP_STATUS requests to a supplier power supply. When no supplier is registered, power_supply_get_property_from_supplier() returns -ENODEV and leaves the output value untouched, and max17040_get_property() ignores that error and returns success. On systems that use the fuel gauge without a charger supplier relationship in firmware, userspace applications can therefore read an uninitialized battery status value, leading to incorrect battery state reporting. Red Hat rates this flaw as moderate severity (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local attack vector requiring privileges. All currently assessed Red Hat products, including Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in the shipped kernel packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.