The MAX17040 fuel‑gauge driver repeatedly reschedules a polling function via cancel_delayed_work(). When a system suspend operation occurs concurrently, the cancel_delayed_work() call only cancels a pending instance and does not wait for a callback that is already executing. Consequently, the polling routine may continue to run after the suspend handler has finished, allowing the driver to access the fuel‑gauge hardware while the system is suspended. This race can result in inconsistent reads or other erratic driver behavior, but the CVE description does not indicate any crash, memory corruption, or data loss.

All Linux kernel releases that include the unpatched MAX17040 power‑supply driver are potentially affected. Any system that uses the unmodified driver during suspend cycles is at risk.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 % suggests an extremely low likelihood of exploitation. The issue is not listed in the CISA KEV catalog, and the CVE documentation does not describe a remote or publicly available exploit. Exploitation would require local or privileged access to induce a race condition between suspend and the driver’s polling callback; no public remote exploitation scenarios are documented.