CVE-2026-89444: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
setattribute() populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer(), then dumps the whole request buffer with printhexdumpbytes(). This can expose the plaintext admin password in the kernel log.
The same issue was fixed for the password attribute path by commit d1a196e0a6dc ("platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data"). Remove the remaining dump from the BIOS attribute path.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (platform/x86: dell-wmi-sysman)to a version that resolves this vulnerability.Patch d1a196e0a6dc - Operational
Remove the remaining dump from the BIOS (as stated: "Remove the remaining dump from the BIOS").
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel dell-wmi-sysman driver are exposed when a BIOS attribute request includes the current administrator password. The risk is disclosure of that plaintext password through the kernel log.
What action triggers the password disclosure?
The disclosure occurs when set_attribute() populates the BIOS attribute request buffer's security area with the current administrator password and then hex-dumps the entire request buffer to the kernel log.
How can I tell whether a system may already be affected?
Review kernel logs for hex dumps produced during BIOS attribute updates through dell-wmi-sysman. Such dumps may contain the plaintext administrator password in the request buffer's security area.
What can be done if the fix cannot be applied immediately?
Avoid BIOS attribute updates through the affected dell-wmi-sysman set_attribute() path when they require the current administrator password, and restrict access to kernel logs that may already contain exposed credentials.