CVE-2026-23370: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
setnewpassword() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.130.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Remove the hex dump from platform/x86/dell-wmi-sysman set_new_password() so plaintext current and new password data is not leaked.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23370?
CVE-2026-23370 has been classified as a medium severity vulnerability due to its potential exposure of plaintext password data.
How do I fix CVE-2026-23370?
To fix CVE-2026-23370, you should update your Linux kernel to the latest patched version provided by your distribution vendor.
What systems are affected by CVE-2026-23370?
CVE-2026-23370 affects systems running impacted versions of the Linux kernel that utilize the dell-wmi-sysman module.
What type of vulnerability is CVE-2026-23370?
CVE-2026-23370 is a vulnerability that allows for the exposure of sensitive plaintext password data due to improper handling in memory.
What happens if CVE-2026-23370 is exploited?
If exploited, CVE-2026-23370 could allow unauthorized access to sensitive passwords, potentially compromising system security.