CVE-2026-23370: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
setnewpassword() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the code so that set_new_password() no longer hex dumps the buffer containing plaintext current/new passwords (remove the hex dump of plaintext password data).
Linux kernel (platform/x86: dell-wmi-sysman) Remove hex dump of plaintext password data in set_new_password() = hex dump disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23370?
CVE-2026-23370 has been classified as a medium severity vulnerability due to its potential exposure of plaintext password data.
How do I fix CVE-2026-23370?
To fix CVE-2026-23370, you should update your Linux kernel to the latest patched version provided by your distribution vendor.
What systems are affected by CVE-2026-23370?
CVE-2026-23370 affects systems running impacted versions of the Linux kernel that utilize the dell-wmi-sysman module.
What type of vulnerability is CVE-2026-23370?
CVE-2026-23370 is a vulnerability that allows for the exposure of sensitive plaintext password data due to improper handling in memory.
What happens if CVE-2026-23370 is exploited?
If exploited, CVE-2026-23370 could allow unauthorized access to sensitive passwords, potentially compromising system security.