{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89461", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.708Z", "datePublished": "2026-09-11T19:43:23.323Z", "dateUpdated": "2026-09-11T19:43:23.323Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:43:23.323Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: max17040: synchronize work cancellation on suspend\n\nmax17040_work() requeues itself after every poll. cancel_delayed_work()\nonly cancels a pending instance and does not wait for a callback that is\nalready running.\n\nIf system suspend races with the polling callback, the callback can\ncontinue accessing the fuel gauge and requeue itself after the suspend\ncallback returns.\n\nUse cancel_delayed_work_sync() to ensure polling is quiesced before\nsuspend completes."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/supply/max17040_battery.c"], "versions": [{"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "5a863417fb9a1034ab1cfe4fa0de46ce1f95f3ec", "status": "affected", "versionType": "git"}, {"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "aad7247bd35ad44af90a5e8974cdff614235b497", "status": "affected", "versionType": "git"}, {"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "36e6ce0f402f965328b27fd31ac793110e8a0c39", "status": "affected", "versionType": "git"}, {"version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "lessThan": "86a3a8a926aa5969c329d1df2d3259f189961bbc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/power/supply/max17040_battery.c"], "versions": [{"version": "2.6.31", "status": "affected"}, {"version": "0", "lessThan": "2.6.31", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5a863417fb9a1034ab1cfe4fa0de46ce1f95f3ec"}, {"url": "https://git.kernel.org/stable/c/aad7247bd35ad44af90a5e8974cdff614235b497"}, {"url": "https://git.kernel.org/stable/c/36e6ce0f402f965328b27fd31ac793110e8a0c39"}, {"url": "https://git.kernel.org/stable/c/86a3a8a926aa5969c329d1df2d3259f189961bbc"}], "title": "power: supply: max17040: synchronize work cancellation on suspend", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/power/supply/max17040_battery.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5a863417fb9a1034ab1cfe4fa0de46ce1f95f3ec", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}, {"lessThan": "aad7247bd35ad44af90a5e8974cdff614235b497", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}, {"lessThan": "36e6ce0f402f965328b27fd31ac793110e8a0c39", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}, {"lessThan": "86a3a8a926aa5969c329d1df2d3259f189961bbc", "status": "affected", "version": "c6f4a42de60b981dd210de01cd3e575835e3158e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/power/supply/max17040_battery.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"lessThan": "2.6.31", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: max17040: synchronize work cancellation on suspend\n\nmax17040_work() requeues itself after every poll. cancel_delayed_work()\nonly cancels a pending instance and does not wait for a callback that is\nalready running.\n\nIf system suspend races with the polling callback, the callback can\ncontinue accessing the fuel gauge and requeue itself after the suspend\ncallback returns.\n\nUse cancel_delayed_work_sync() to ensure polling is quiesced before\nsuspend completes."}], "id": "CVE-2026-89461", "lastModified": "2026-09-11T20:19:27.037", "metrics": {}, "published": "2026-09-11T20:19:27.037", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/36e6ce0f402f965328b27fd31ac793110e8a0c39"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a863417fb9a1034ab1cfe4fa0de46ce1f95f3ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86a3a8a926aa5969c329d1df2d3259f189961bbc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aad7247bd35ad44af90a5e8974cdff614235b497"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: max17040 driver resource management issue during system suspend", "id": "2532186", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532186"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["A flaw was found in the Linux kernel's `max17040` power supply driver. A timing issue, known as a race condition, can occur during system suspend. This allows a background process (polling callback) to continue accessing the fuel gauge and restart itself even after the system suspend has finished. This could lead to unexpected system behavior or resource management problems."], "name": "CVE-2026-89461", "public_date": "2026-09-11T19:43:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89461\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89461\nhttps://git.kernel.org/stable/c/36e6ce0f402f965328b27fd31ac793110e8a0c39\nhttps://git.kernel.org/stable/c/5a863417fb9a1034ab1cfe4fa0de46ce1f95f3ec\nhttps://git.kernel.org/stable/c/86a3a8a926aa5969c329d1df2d3259f189961bbc\nhttps://git.kernel.org/stable/c/aad7247bd35ad44af90a5e8974cdff614235b497"], "threat_severity": "Moderate"}

{"created": "2026-09-12T03:00:10.895061+00:00", "updated": "2026-09-12T03:00:10.895067+00:00", "vendors": []}