CVE-2026-89466

In the Linux kernel, the following vulnerability has been resolved:

power: supply: qcom battmgr: terminate the strings from firmware

The qcom battmgr sc8280xp strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR STRING LEN bytes and leaves the destination without a terminator.

Those destinations are model number, serial number and oem info, each BATTMGR STRING LEN and declared next to each other. They go out to user space as val->strval, which power supply format property() prints with "%s", so a firmware string that fills the whole field makes that read run into the following members.

Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field.