https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:06:44 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89466 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: qcom_battmgr: terminate the strings from firmware</p> <p>The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator.</p> <p>Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val-&gt;strval, which power_supply_format_property() prints with &#34;%s&#34;, so a firmware string that fills the whole field makes that read run into the following members.</p> <p>Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>power: supply: qcom_battmgr: terminate the strings from firmware</p> <p>The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator.</p> <p>Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val-&gt;strval, which power_supply_format_property() prints with &#34;%s&#34;, so a firmware string that fills the whole field makes that read run into the following members.</p> <p>Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.</p> https://vulnerability.circl.lu/vuln/cve-2026-89466