A race condition exists in the Linux kernel driver for the MAX17040 fuel gauge where the work routine requeues itself after each polling interval. The driver uses cancel_delayed_work() to cancel pending work, but this does not wait for a currently executing callback. When the system enters suspend, the polling callback can still run and, after the suspend callback returns, requeue itself to continue accessing the fuel gauge. This oversight where power management may be in transition, potentially causing incorrect reads, data corruption, or a crash. The weakness is a classic race condition (CWE‑821).

The vulnerability affects all Linux kernel versions that include the MAX17040 driver code without the synchronization fix. No specific version range is listed, so any kernel build that contains the affected driver path is potentially impacted. Devices that use the MAX17040 fuel gauge, such as certain embedded boards or laptops, are the most likely platforms to experience this issue.

The CVSS score of 5.5 denotes moderate severity, while the EPSS score of <1% indicates a very low but non‑zero probability; the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an attacker would need the ability to trigger or control suspend‑resume cycles while the driver is active, which normally requires local privilege or the ability to affect power management from user space. No public remote exploitation has been documented, and exploitation would be limited to environments where the attacker can induce the race condition before the system suspends.