EUVD-2026-76372
GHSA-g9cw-qg44-9g2q
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
OOB read across contiguous struct fields leaks kernel data to userspace; no crash path identified, so A:N rather than A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
power: supply: qcom_battmgr: terminate the strings from firmware
The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator.
Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val->strval, which power_supply_format_property() prints with "%s", so a firmware string that fills the whole field makes that read run into the following members.
Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.
AnalysisAI
Missing null termination in the Qualcomm battery manager driver (qcom_battmgr) causes the kernel to read beyond a string buffer boundary when firmware on SC8280XP-based devices returns a string that exactly fills the BATTMGR_STRING_LEN field. The three contiguous string fields - model_number, serial_number, and oem_info - are exposed to userspace via the power supply sysfs interface using a bare "%s" format, meaning an unterminated firmware string causes the kernel to traverse into adjacent struct members and leak their contents to unprivileged local readers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a physical system running Qualcomm SC8280XP hardware (e.g., Lenovo ThinkPad X13s or Qualcomm Reference Design laptops) with the qcom_battmgr kernel module loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 rating with AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H reflects local exploitation requiring no OS-level privileges, consistent with world-readable sysfs power supply attributes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Linux kernel to 6.12.109, 6.18.50, or 7.2.4 depending on the stable branch in use, or build from 7.3-rc1 or later for mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify inventory of SC8280XP-based devices currently deployed (primarily edge computing appliances, industrial IoT, or enterprise Android platforms running Linux kernels 6.x-7.x). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today