In the Linux kernel, the max17040 power supply driver fails to propagate I2C register read errors. When a transfer fails, an uninitialized register value is converted and reported to user space as measurement. Additionally, the worker thread may replace with this bogus value and emit a spurious change event, confusing systems that depend on accurate battery telemetry and potentially triggering false alarms or incorrect power‑management decisions.

All Linux kernel installations that use the max17040 battery gauge driver are affected. The vulnerability is present in the Linux power supply subsystem for the max17040 device. No specific kernel version is listed in the CVE data; the issue appears in any version containing the unpatched driver code.

The CVSS score is 5.3, indicating a moderate severity vulnerability. The EPSS score is 0.00168 (≈0.17%), and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker would need access to the I2C bus to trigger a communication failure or the driver’s error path. The flaw does not provide execution or privilege escalation, but it does allow the delivery of falsified battery metrics and unintended change events, which can degrade system reliability and lead to improper power‑management behavior. Consequently the risk remains moderate, primarily affecting information integrity and availability of power‑sensing functions.